worksome/uk-tax-code-validator

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. The recent release provides some compensating evidence, but the quiet period lowers confidence in ongoing maintenance.

Repo toolingcaution

The repository uses Composer build tooling, but no security scanning tools were detected. The absence of scanning is a transparency and hygiene gap rather than evidence of an unsafe release.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

All nine analyzed action references are unpinned, and a high-confidence bot-condition finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is a workflow hygiene concern rather than a severe standalone risk.