shopsys/luigis-box

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected; the missing scanner is a modest transparency gap rather than a severe risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented; the active project backing partly offsets this gap but does not remove it.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous findings or untrusted checkout paths. However, both action references are unpinned, which weakens build reproducibility and supply-chain hygiene.