vanilo/cart

Repo bus factorcaution

All 3 recent commits came from one contributor, creating a meaningful concentration risk. Organizational backing partly compensates because maintenance can potentially be handed off.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a modest transparency and hygiene gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed with no audit findings and no top-level write permissions; however, all 3 analyzed action references are unpinned, reducing build reproducibility. The pull_request_target trigger is not concerning by itself because no untrusted checkout or injection sink was found.