p-throttle

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving release origin less independently verifiable even though other maintenance signals are strong.

Repo toolingcaution

The repository reports no build tool or security scanning tool. This is a transparency and process gap, but the package is small and the repository still includes a security policy and a tested source tree.

Token permissionscaution

The only workflow lacks top-level permissions, so its token access is not explicitly minimized. No workflow requests top-level write access, which limits the concern.