domhandler

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all commits in the last three months, leaving maintenance capacity concentrated in a single person.

Repo commit activitycaution

Only one commit was recorded in the last three months, which is thin direct commit activity, although the recent release and merged pull requests provide some compensation.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less explicit for users and maintainers.

Workflow auditcaution

The audit found a high-confidence bot-condition issue and 13 of 15 action references are unpinned; the low-confidence cache-poisoning finding is only a hygiene concern. The pull_request_target workflow has no untrusted checkout or script-injection sink, limiting the trigger's impact.