dotenv-expand

Lifecycle scriptscaution

A prepack lifecycle script is used, adding some build-time complexity, but this is limited to packaging rather than an install-time script executed by consumers.

Repo bus factorcaution

All 19 recent commits came from one contributor, creating a meaningful continuity risk. Organization ownership provides some ability to hand maintenance off, but no second active contributor is shown.

Repo toolingcaution

The repository uses esbuild, TypeScript, and npm scripts, indicating a structured build; however, no security scanning tools were detected.

Security policycaution

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting and response expectations unclear.

Token permissionscaution

The single workflow has no top-level token permissions declaration. No write permissions were detected, but explicitly limiting permissions would provide stronger workflow hygiene.