spryker-feature/marketplace-order-management

Repo bus factorcaution

One contributor made all three recent commits, creating a concentrated maintenance path. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

Only three commits were recorded in the last three months, all from one active maintainer. Recent activity exists, but the low volume and concentration limit evidence of broad maintenance capacity.

Repo toolingcaution

Composer is used for builds, but no security-scanning tooling was detected. That is a modest transparency and assurance gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy. For a package with merchant-order functionality, this reduces clarity about vulnerability reporting and maintenance response.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-confidence audit findings, but all four action references are unpinned. The absence of a top-level permissions block is acceptable on its own; unpinned actions remain a build-integrity hygiene concern.