tag1/scolta-php

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tool was detected, leaving a modest supply-chain hygiene gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

The audit completed all four workflows and found no untrusted checkout or script-injection path, but 45 of 47 actions are unpinned and it reported four high-confidence template-injection findings in CI. The top-level write permission is limited to one workflow, so the main concern is workflow hygiene rather than a demonstrated severe exposure.