cpy

Project backingcaution

The repository is owned by a user account rather than an organization, so the single-maintainer concentration is not visibly offset by organizational backing.

Repo bus factorcaution

One contributor made 100% of the four recent commits, leaving maintenance capacity concentrated in a single person.

Repo toolingcaution

The project uses TypeScript build tooling, but no security-scanning tools were detected, leaving a modest transparency and maintenance gap.

Workflow auditcaution

The workflow audit completed fully with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, both analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.