morningtrain/economic

Workflow auditdanger

All four workflows were analyzed, but all nine action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a meaningful hygiene and automation risk rather than a standalone severe failure.

Security policycaution

The repository has no published security policy. That is a transparency gap for an SDK that handles API integrations, although Dependabot scanning and active maintenance partly offset it.