knip

Build provenancecaution

No build attestation is present, which limits independently verifiable release provenance, though staged publishing and a named approver provide some compensating release controls.

Repo bus factorcaution

The top contributor made about 74% of recent commits, creating concentration risk, but 23 contributors were active and the repository is organization-owned, which provides some handoff capacity.

Repo toolingcaution

The repository reports no build tool or security-scanning tooling, leaving a modest process-transparency gap despite the strong observed release and commit activity.

Security policycaution

No repository security policy is published, reducing clarity about vulnerability reporting and response; this is a documentation gap rather than evidence of unsafe code.