juice

Build provenancecaution

The release has no build attestation or trusted-publisher identity, which reduces publication transparency, although the active repository and release history provide compensating maintenance evidence.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear; this is a transparency gap rather than evidence of abandonment.

Workflow auditcaution

All 7 analyzed action references are unpinned, and one workflow grants top-level write access. The low-confidence cache-poisoning finding is hygiene-level only, but the pinning gap warrants caution.