bcp-47

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity is not buffered by visible organizational handoff capacity. The active second contributor provides only partial compensation.

Repo bus factorcaution

Two contributors were active, but one made 13 of 14 recent commits, so maintenance is heavily concentrated. The second contributor provides limited mitigation, making this a moderate resilience concern.

Repo toolingcaution

The project uses TypeScript and npm scripts, but no security-scanning tool was detected. That is a modest transparency and hygiene gap, not evidence of unsafe code by itself.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although active commits and a current release provide some compensating maintenance evidence.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all three action references are unpinned, which leaves avoidable supply-chain hygiene risk.