normalize-url

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single-maintainer concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 17 recent commits came from one contributor, creating a meaningful continuity risk; the active commit cadence partly compensates but does not remove the concentration.

Repo toolingcaution

No build tool or repository security-scanning tool was detected. This is a modest transparency and process gap for an otherwise small package.

Workflow auditcaution

The single workflow was fully analyzed with no audit findings, no untrusted checkouts, and no script injection; however, both action references are unpinned, which weakens build reproducibility.