spryker/tax-storage

Licensecaution

The release declares a proprietary license and includes a LICENSE file, so it is licensed rather than undocumented. However, proprietary terms may restrict use or redistribution and should be checked for project compatibility.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tool was detected. The missing scanning process is a modest transparency concern, not evidence of unsafe code by itself.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a process gap, though the active organization-backed project partly reduces abandonment concern.

Workflow auditcaution

The single workflow was fully analyzed with no reported audit findings, no untrusted checkouts, and no script injection. Two of four action references are unpinned, which is a minor reproducibility concern; the workflow has no top-level permissions block and no broad write permissions.