apexcharts

Repo bus factorcaution

Although 12 maintainers contributed recently, one contributor made about 89% of the 535 commits, leaving meaningful dependence on a single individual. Organization backing partly reduces handoff risk.

Security policycaution

No SECURITY.md policy was found. This is a transparency gap for reporting vulnerabilities, although active development and CodeQL scanning provide some compensation.

Workflow auditcaution

All 8 workflows were analyzed without untrusted checkouts or script injection, but all 19 action references are unpinned, one publish workflow has top-level write permissions, and a high-confidence audit found adhoc package installation. These are workflow hygiene concerns, not severe evidence on their own.