parse-statements

Build provenancecaution

The release has no build attestation or trusted-publisher provenance, so consumers cannot independently verify how the artifact was produced.

Repo bus factorcaution

One contributor made all two recent commits, creating a concentrated maintenance point. Organization ownership provides some ability to hand maintenance off, partly compensating for that concentration.

Repo commit activitycaution

Only two commits were recorded in the last three months, so recent maintenance activity is light despite the recent release.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented. This is a transparency gap, not evidence of unsafe code.