path2d

Repo bus factorcaution

Two contributors are active, but one accounts for 75% of recent commits; this is a mild concentration risk without evidence that the project has broader organizational backing.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All 12 analyzed action references are unpinned and three workflows grant top-level write permissions, creating workflow hygiene and blast-radius concerns. The only audit finding is low-confidence cache-poisoning in CI, so it does not independently establish a severe risk.