spryker/code-sniffer

Repo bus factorcaution

One contributor made 17 of 19 commits in the last 3 months, or about 89%, so maintenance is materially concentrated. Organization backing provides some handoff capacity but does not remove the continuity concern.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it is not evidence that the package is unsafe.

Workflow auditcaution

All 9 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene. The workflow has no dangerous trigger-to-sink combination, no write-wide permissions, and no audit findings, which limits the impact to caution.