domino

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between source and published artifact less verifiable. This is a supply-chain transparency gap rather than a health verdict on its own.

Repo bus factorcaution

One contributor made all five commits in the last three months, leaving maintenance dependent on a single active contributor. The repository's long history and recent release activity partly compensate, but concentration remains a real continuity concern.

Repo toolingcaution

The repository reports no build tools and no security scanning tools. This is a transparency and maintenance-process gap, though the package is simple and has a small dependency profile.

Security policycaution

No repository security policy was found. This weakens vulnerability-reporting transparency, although it does not by itself indicate abandonment.