chevrotain

Repo bus factorcaution

All 14 recent commits came from one contributor, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and disclosure expectations undocumented.

Workflow auditcaution

All 7 analyzed action references are unpinned and one workflow grants top-level write access. The two cache-poisoning findings are low-confidence hygiene warnings, with no untrusted checkout or script-injection path observed.