flatted

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable than it could be.

Maintainerscaution

Only one registry account has publish access. This is a real publishing continuity concern, although repository activity shows that the account is actively maintaining the project.

Project backingcaution

The repository is owned by a user rather than an organization, so the single-maintainer concentration is not offset by visible organizational handoff capacity.

Repo bus factorcaution

All 7 recent commits came from one contributor, creating a concentrated maintenance dependency and increasing abandonment risk if that contributor becomes unavailable.

Token permissionscaution

All three workflows lack top-level permission declarations, and none explicitly declares read-only permissions; although no top-level write access was observed, this weakens least-privilege clarity.