spryker-feature/configurable-product-wishlist

Repo bus factorcaution

One release-bot contributor accounts for all recent commits, so observed activity is concentrated. Because the repository is owned by an organization, handoff capacity reduces—but does not eliminate—the concern.

Repo commit activitycaution

Only 2 commits from 1 active maintainer were recorded in the last 3 months, indicating limited direct activity. The recent release and organizational ownership partly compensate for that narrow activity.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap rather than evidence of unsafe behavior.

Security policycaution

The repository has no published security policy. That reduces transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The workflow audit completed successfully with no injection or high-confidence audit findings, and it has no top-level write permissions. However, all 4 action references are unpinned, leaving a modest reproducibility and supply-chain hygiene gap.