moneyphp/money

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a modest transparency and maintenance gap.

Security policycaution

No repository security policy was found, so vulnerability reporting expectations are less clear for consumers and maintainers.

Workflow auditcaution

All 20 analyzed action references are unpinned, and three high-confidence findings identify unpinned container images in checks.yml. The audit was complete and found no untrusted checkout or script-injection path, limiting this to a workflow-hygiene concern.