bonjour-service

Build provenancecaution

No build attestation, trusted publisher, or staged publishing is reported, leaving release origin and artifact-to-source verification less transparent.

Dangerous workflowscaution

One workflow uses pull_request_target, which warrants review because it can run with elevated repository context; however, no untrusted checkout or script-injection pattern was detected.

Maintainerscaution

Only one registry account has publish access, which is a modest publishing continuity concern; the organization-owned repository and active repository work provide some compensating backing.

Repo bus factorcaution

One contributor made 13 of 14 recent commits, creating concentrated maintenance risk. A second active contributor and organization backing partially compensate, so this remains a caution rather than a severe risk.

Security policycaution

No repository security policy is present, reducing transparency about vulnerability reporting and maintainer response procedures.