spryker-feature/multiple-carts

Repo bus factorcaution

All two recent commits came from one release bot, so observed activity is highly concentrated. Organization ownership provides some handoff capacity, but the collected activity still leaves a modest maintenance risk.

Security policycaution

The repository has no security policy, which weakens disclosure transparency. This is a limited concern because the package is actively released and the repository is organization-backed.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, injection findings, or excessive permissions, but all four action references are unpinned. That creates a supply-chain hygiene gap without evidence of an actively dangerous workflow.