@rive-app/canvas

Maintainerscaution

Four of five publish-access accounts use the rive.app domain, and the organization-backed project makes that concentration normal; the single gmail.com account, luigi-rosso, is a minor account-hygiene caution but not evidence of limited maintenance capacity.

Repo toolingcaution

No build tool or security-scanning tool was detected in the collected repository metadata, leaving a modest process and assurance gap.

Security policycaution

The repository has no SECURITY.md or other detected security policy, reducing transparency about vulnerability reporting and response.

Workflow auditcaution

All 13 action references are unpinned and one workflow grants top-level write access, creating workflow hygiene concerns. High-confidence template-injection findings in number.yaml and publish.yml are worth review, but no untrusted checkout or script-injection sink was found, so this is not a severe health risk on its own.