rollun-com/rollun-openapi

Licensecaution

The artifact includes a license file and the repository also has one, but the manifest declares MIT while the detected license is BSD-3-Clause; that inconsistency reduces transparency.

Lifecycle scriptscaution

A post-create-project-cmd script runs during project creation, adding installation-time behavior that consumers should inspect, although this is not by itself evidence of unsafe code.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tooling was detected; this is a modest repository hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no published security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were fully analyzed with no reported findings or dangerous untrusted-trigger sinks, but both action references are unpinned, leaving avoidable dependency-integrity risk.