css-what

Project backingcaution

The repository is maintained by an individual rather than an organization, so the single-maintainer concentration is a genuine continuity concern rather than an organizational handoff pattern.

Repo bus factorcaution

All five recent commits came from one contributor, so maintenance depends heavily on a single person. The long project history and recent release activity reduce but do not remove that continuity risk.

Security policycaution

No repository security policy is present. This is a transparency and vulnerability-reporting gap, although CodeQL and Dependabot provide some compensating security practice.

Workflow auditcaution

All workflows were analyzed, but eight of ten action references are unpinned and a high-confidence bot-conditions finding affects the Dependabot automerge workflow. The cache-poisoning finding is low confidence and is only a hygiene concern.