shopware/conflicts

Repo toolingcaution

The project uses Composer build tooling, appropriate for this package. No security-scanning tool was detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, so vulnerability reporting expectations are not documented. This is a transparency gap, but it is partly offset by the organization-backed, actively maintained repository.

Workflow auditcaution

All 5 workflows were analyzed, but 2 files failed audit, making the review incomplete. Six of 7 action references are unpinned and 2 workflows grant top-level write access; no untrusted checkout or script-injection paths were found, so this is a hygiene caution rather than a severe risk.