claude-mem

Project backingcaution

The repository is owned by a named individual rather than an organization, so continuity depends on a narrower ownership base. This is partly offset by the repository's very strong recent release and contribution activity.

Repo toolingcaution

The project uses TypeScript, npm scripts, esbuild, and tsup, showing an established build process. No security scanning tools were detected, which is a modest transparency and hygiene gap.

Workflow auditcaution

All 8 workflows were analyzed with no untrusted checkouts or script injection, and four scope permissions at job level. However, all 36 action references are unpinned, and the high-confidence trusted-publishing finding indicates registry publishing uses a long-lived token; the low-confidence cache findings are hygiene concerns only.