@react-three/drei

Repo bus factorcaution

All 4 recent commits came from one contributor. Organization backing reduces the handoff concern somewhat, but no second recently active contributor is shown.

Repo commit activitycaution

Only 4 commits were recorded in the last 3 months, with one active maintainer. Release and pull-request activity provide some compensation, but the direct commit pace is thin.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. This is a transparency gap, though it is not evidence of unsafe code by itself.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, or audit findings, and two scope permissions at job level. However, all 9 action references are unpinned, creating avoidable build-integrity risk.