spatie/geocoder

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected; for a small library this is a modest supply-chain hygiene gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance unclear; this is a transparency gap rather than evidence of abandonment.

Workflow auditcaution

All 8 action references are unpinned, and the audit found a high-confidence, high-severity unpinned container image in php-cs-fixer.yml. No untrusted checkout or script-injection path was found, limiting the impact to CI reproducibility and workflow supply-chain hygiene.