beasties

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated maintainer activity has less organizational redundancy.

Repo bus factorcaution

The leading contributor made about 79% of recent commits, which is concentrated, but six other contributors were active during the same three-month period.

Security policycaution

The repository has no SECURITY.md or other declared security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout, script injection, or high-severity findings, and all 18 action references are pinned. One workflow has top-level write permissions and the audit reported use-trusted-publishing, but these are moderated by the absence of an identified untrusted sink and the release's provenance attestation.