vatnode/eu-vat-rates-data

Repo bus factorcaution

All recent repository commits came from one contributor, leaving a concentrated maintenance path; organization backing provides some handoff capacity but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, so observed development activity is currently thin despite the frequent registry releases.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, which reduces transparency about vulnerability reporting and response.

Workflow auditcaution

Both workflows were analyzed successfully, but all three action references are unpinned. The audit also found a high-confidence template-injection pattern in update.yml; template injection is a workflow hygiene concern here, while the absence of untrusted checkout and script-injection sinks limits escalation.