spryker-feature/customer-access

Repo bus factorcaution

All three recent commits came from one contributor, the release bot, so direct maintenance capacity is concentrated. Organization backing provides some compensation but does not remove the continuity concern.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tools were detected. This is a modest transparency and supply-chain hygiene gap.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

The sole workflow was fully analyzed with no injection or high-severity findings, but all four action references are unpinned. The absence of a top-level permissions block is acceptable on its own.