tmonier/sylius-purchase-approval-plugin

Maintainerscaution

Only one registry account has publishing access. The linked project is user-owned rather than organization-owned, so there is limited visible publishing redundancy.

Release historycaution

This is a brand-new package with 3 releases in less than 1 day, so there is not enough history to demonstrate sustained maintenance or release stability.

Repo commit activitycaution

The repository reports 0 commits and 0 active maintainers in the last 3 months. Because the package is less than a day old, this is partly expected, but it leaves maintenance capacity unproven.

Security policycaution

The repository has no published security policy, leaving the vulnerability reporting process unclear. This is a transparency gap, not evidence of unsafe code.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous audit findings or untrusted checkout paths. However, both action references are unpinned, so their fetched code is not fixed to reviewed revisions.