path2d-polyfill

Repo bus factorcaution

The leading contributor made 75% of recent commits, but a second contributor accounts for the remaining 25%, partially reducing concentration risk.

Repo toolingcaution

The repository uses TypeScript and build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, which weakens the project's transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All 12 action references are unpinned and three workflows grant top-level write permissions, creating workflow-hygiene concerns. The only audit finding is low-confidence cache-poisoning in CI, with no untrusted checkout or script-injection sink, so this is not a severe workflow risk.