spryker-feature/availability-notification

Repo bus factorcaution

All 4 recent commits came from one release bot, so observed maintenance is highly concentrated. Organization backing partly compensates because responsibility can be handed off, but the measured contributor base remains thin.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling was detected. That leaves a meaningful supply-chain hygiene gap despite the active release process.

Security policycaution

The repository has no published security policy. This weakens vulnerability-reporting transparency, though it is not evidence of abandonment by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 4 action references are unpinned, so workflow inputs are less reproducible and deserve caution.