spryker/security-blocker-merchant-portal-gui

Release historycaution

The package has only two releases since March 2023 and none in the last 12 months, which is a maintenance-cadence concern. However, recent repository activity provides compensating evidence that the project itself has not been abandoned.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. This is a modest supply-chain transparency gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. The active organization and recent contributors partly reduce the maintenance concern but do not replace a stated process.

Token permissionscaution

The single CI workflow has no top-level token permissions declaration. No write permissions were observed, but explicitly limiting CI token access would provide stronger workflow hygiene.