tmonier/sylius-facturx-plugin

Project backingcaution

The repository is owned by an individual rather than an organization, so the two-contributor activity is useful but does not provide institutional handoff capacity.

Release historycaution

Only two releases have appeared since the first release about 1 day ago, so long-term maintenance is not yet demonstrated. The very recent second release shows active early development rather than abandonment.

Security policycaution

The repository has no SECURITY policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, but it is not evidence of unsafe code by itself.

Workflow auditcaution

The only workflow was fully analyzed with no trigger or audit findings, but all 6 action references are unpinned, allowing action changes to affect builds unexpectedly. The absence of a top-level permissions block is acceptable on its own.