bare-path

Repo toolingcaution

The project uses CMake, but no security-scanning tooling was detected; this is a modest transparency gap rather than evidence of abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed and use read-only permissions with no detected high-confidence findings or untrusted checkout paths. However, all 12 action references are unpinned, which weakens build reproducibility and action supply-chain protection.