spryker/merchant-product-offer-data-import

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tools were detected. The missing scanning is a modest transparency and hygiene gap, not evidence of abandonment.

Security policycaution

No repository security policy was found. This leaves vulnerability-reporting expectations unclear and lowers transparency for a package intended for production use.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injections, or audit findings. However, 2 of 4 action references are unpinned, which weakens build reproducibility; the lack of a top-level permissions block is acceptable here because no broad write permissions were observed.