monocart-coverage-reports

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, leaving publication origin less verifiable than it could be. This is a transparency gap, not evidence that the package is unsafe.

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all 11 commits in the last 3 months, leaving maintenance highly concentrated and increasing continuity risk for this user-owned project.

Security policycaution

The repository has no security policy, so users lack a documented route for reporting vulnerabilities or understanding disclosure expectations.

Workflow auditcaution

All 5 workflows were analyzed with no untrusted checkouts or script injection, but all 32 action references are unpinned, two workflows grant top-level write permissions, and three high-confidence audits flag ad hoc package installation. These are workflow hygiene and supply-chain concerns, not severe findings on their own.