vshipdk/php-sdk

Repo bus factorcaution

All recent commits came from 1 contributor, creating a fragile maintenance path. Organization ownership provides some backing, but no second active contributor is shown.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, indicating sparse recent development activity despite the current release.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear for an SDK that handles API integrations.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts or script injection, but all 8 action references are unpinned and one high-confidence finding identifies an archived action. The lack of a top-level permissions block is acceptable on its own.