phreesoft/bizuno

Lifecycle scriptscaution

The package runs post-install and post-update Composer scripts, adding installation-time behavior that consumers should understand before adoption.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented for a security-sensitive accounting application.

Workflow auditcaution

All 15 analyzed action references are unpinned, and one workflow grants top-level write access. High-confidence template-injection findings are present, although no untrusted checkout or dangerous trigger was reported; the low-confidence cache-poisoning finding is hygiene rather than a severe risk.