vufind-org/vufindharvest

Repo toolingcaution

Composer and Phing provide established build tooling, but no security scanning tools were detected, leaving a modest assurance gap.

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, though it is not evidence that the release is unsafe.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts, script injection, or high-severity findings, but all six action references are unpinned. Unpinned actions reduce build reproducibility and supply-chain control.