meshoptimizer

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single-contributor concentration has no visible organizational handoff support.

Repo bus factorcaution

One contributor made all 179 commits in the last three months, so maintenance depends heavily on a single individual and carries a real continuity risk.

Repo toolingcaution

The project uses Make and CMake, but no security-scanning tools were detected, leaving security-process coverage unclear.

Security policycaution

No repository security policy was detected, which weakens transparency around vulnerability reporting and response.

Workflow auditcaution

All 27 action references are unpinned, and the audit found two high-confidence template-injection findings plus an ad hoc package installation. No untrusted checkout or script-injection trigger was found, so these are workflow hygiene and build-integrity concerns rather than standalone severe risk.