shopper/pricelist

Release historycaution

This is the package's first release, published 0 days ago, so there is no release track record or established cadence to assess.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last 3 months. Because the package is newly released, this may reflect its age, but it leaves maintenance capacity unproven.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All 3 workflows were analyzed with no dangerous sinks or audit findings, and none grants top-level write access. However, all 10 action references are unpinned, which weakens build reproducibility and supply-chain hygiene.