citeproc-java

Repo bus factorcaution

Four contributors were active recently, but the leading contributor made about 73% of commits. Because the project is backed by an individual rather than an organization, this concentration is a modest continuity concern.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

Both workflows were analyzed without high-confidence audit findings or untrusted-code sinks, but all 5 action references are unpinned and one workflow grants top-level write permissions. The unpinned references warrant a hygiene caution, while the write scope is not independently severe here.