i18next-fs-backend

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release provenance less independently verifiable.

Repo bus factorcaution

All four recent commits came from one contributor, creating concentration risk. Organization ownership partially compensates because maintenance can potentially be handed off, but no second recent contributor is shown.

Repo toolingcaution

The repository uses TypeScript and Babel build tooling, but no security scanning tools are configured, leaving a security-hygiene gap.

Token permissionscaution

Neither workflow declares top-level token permissions, and neither explicitly declares read-only permissions. Although no write permissions are observed, the lack of explicit least-privilege declarations is a workflow-hardening gap.