shipstream/spscommerce-php-sdk

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release partly offsets this, but the quiet source activity is a maintenance concern.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a transparency and maintenance gap rather than evidence of an unsafe release by itself.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations unclear.

Workflow auditcaution

The only workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted checkout paths. However, both of its two action references are unpinned, which weakens build reproducibility and supply-chain hygiene.