pariette/signalbird

Repo toolingcaution

The project uses Composer, but no security-scanning tools were detected. The build setup is present, while the missing automated security tooling is a modest transparency gap.

Security policycaution

The repository has no security policy. For an SDK handling messaging, management, and authentication-related capabilities, this weakens documented vulnerability-reporting processes.

Workflow auditcaution

All 24 action references are unpinned, which weakens build reproducibility, and the publish workflow uses trusted publishing patterns flagged with high confidence. The cache findings are low-confidence hygiene observations, while the workflows otherwise lack untrusted checkouts and script injection.