@vue-macros/common

Repo bus factorcaution

All recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some ability to hand maintenance off, so this is a caution rather than a severe abandonment signal.

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, so the linkage is less transparent even though it may be a legitimate monorepo sub-package.

Repo toolingcaution

The project uses established build and test tooling, but no security-scanning tools were detected. The missing scanning is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted sinks, and one scopes permissions at job level. However, all four action references are unpinned, which weakens workflow reproducibility and supply-chain hygiene.