detective-vue2

Build provenancecaution

No build attestation or trusted-publisher provenance is available, limiting publication transparency. The clear repository match and active release history provide some compensating context.

Repo bus factorcaution

All two recent commits came from one contributor, leaving maintenance dependent on a single active person. Organization backing provides some capacity for handoff, but no second recent contributor is evidenced.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

All three workflows were analyzed, use read-only permissions, and contain no high- or medium-severity findings. However, all seven action references are unpinned, which weakens reproducibility and supply-chain control.