errx

Dangerous workflowscaution

One of five workflows uses pull_request_target, which warrants review because it can run with elevated repository context, but no untrusted checkout or script injection was detected.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the one-maintainer concentration represents a genuine continuity risk rather than expected organizational ownership.

Repo bus factorcaution

All 15 commits in the last three months came from one contributor, leaving a meaningful single-maintainer continuity risk. The active release and merge activity partly offsets abandonment concerns but does not remove the concentration.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities should be reported and handled.

Token permissionscaution

Most workflows use read-only permissions, but one workflow has top-level write access and another lacks top-level permissions, leaving some CI privilege configuration less explicit than ideal.