dotenv

Build provenancecaution

No registry attestation or trusted-publisher identity is present, leaving publication provenance less verifiable even though the project has other transparency controls.

Project backingcaution

The repository is owned by a user rather than an organization, so the concentrated commit activity has less organizational handoff support.

Repo bus factorcaution

One contributor made 74 of 86 commits, or about 86%, so maintenance is materially concentrated despite 10 active contributors.

Workflow auditcaution

The single workflow was fully analyzed with no findings or untrusted checkouts, but both of its two action references are unpinned, leaving dependency versions less reproducible.