mutation-testing-metrics

Repo bus factorcaution

Only two contributors were active in three months, with the top contributor responsible for about 69% of commits; the organization-owned project and second active contributor partly offset this concentration.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention mutation-testing-metrics, so the package-to-repository relationship is not transparent; the monorepo context reduces but does not remove this concern.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less transparent for consumers.

Workflow auditcaution

All four workflows were analyzed without untrusted checkouts or script injection, and none has top-level write permissions. However, all 10 action references are unpinned and a high-confidence finding reports blanket permissions on an app token in update-screenshots.yml.