shopsys/coding-standards

Repo toolingcaution

The project uses Composer for builds, which fits the ecosystem. No security-scanning tool was detected, leaving a modest security-process gap but not evidence of abandonment.

Security policycaution

The repository has no SECURITY.md or other detected security policy. This weakens vulnerability-reporting transparency, although recent commits and organization backing partly offset the concern.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Both action references are unpinned, which weakens build reproducibility; the absence of a top-level permissions block is acceptable on its own.