defuddle

Repo bus factorcaution

Seven contributors were active, but one contributor made 48 of 54 commits, leaving maintenance heavily concentrated despite broader participation.

Repo toolingcaution

The project uses TypeScript, webpack, Vitest, and npm scripts, but no security-scanning tools were detected, leaving a modest review gap.

Security policycaution

No security policy was found in the repository, which reduces transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All 9 action references are unpinned and one release workflow has top-level write permissions. The only audit finding is low-confidence cache-poisoning hygiene, with no untrusted checkout or script-injection paths, so this is a moderate workflow concern rather than a severe risk.