shipmonk/coding-standard

Repo bus factorcaution

All three recent commits came from one contributor, creating a real continuity risk; organization backing partly compensates because maintenance can be handed off.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, which makes vulnerability-reporting expectations less clear, although this is a hygiene concern rather than evidence of abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all four action references are unpinned, so build inputs are less reproducible.