vanilo/taxes

Repo bus factorcaution

One contributor made all seven commits in the last three months, leaving no demonstrated second active maintainer. Organization backing provides some continuity, but the current activity still has a narrow operational base.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. This is a modest transparency and maintenance gap rather than evidence of a severe problem.

Security policycaution

The repository has no security policy, so there is no documented process for reporting and handling vulnerabilities. This lowers project transparency.

Workflow auditcaution

Both workflows were analyzed cleanly and contain no reported audit findings; the pull_request_target trigger has no untrusted checkout or script-injection sink. All three action references are unpinned, leaving a reproducibility and workflow supply-chain hygiene gap.