vanilo/order

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful sign of slowed maintenance; the recent push provides only limited compensation.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving repository-level security hygiene weaker than it could be.

Security policycaution

The repository has no security policy, reducing transparency about how maintainers handle vulnerability reports.

Workflow auditcaution

Both workflows were analyzed successfully, but all 3 action references are unpinned and a high-confidence finding reports an unpinned container image. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently dangerous.