@simplewebauthn/browser

Project backingcaution

The repository owner is an individual rather than an organization, so the concentrated recent contribution pattern has no demonstrated organizational handoff buffer.

Repo bus factorcaution

One contributor made 96% of the 25 recent commits, leaving the project dependent on a highly concentrated maintainer base despite a second active contributor.

Repo toolingcaution

The repository reports no build tool and no security-scanning tools; the missing security scanning is a modest transparency and hygiene concern, though active tests and review activity compensate partly.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear for a security-sensitive WebAuthn library.

Workflow auditcaution

All three workflows were analyzed without high- or medium-severity findings, and two scope permissions at job level. However, all 12 action references are unpinned and two publishing workflows install packages outside a lockfile, creating reproducibility and workflow-hygiene concerns.