plimit-lit

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the relationship between the published artifact and its source less independently verifiable.

Maintainerscaution

Only one registry account has publish access. That is a real continuity concern for a user-owned project, although the repository shows recent releases and commits from the same maintainer.

Repo bus factorcaution

All 2 recent commits came from one contributor, so maintenance could be disrupted if that person becomes unavailable; the established release history partly offsets this risk.

Security policycaution

The repository has no security policy. This is a transparency gap for vulnerability reporting, though it does not by itself indicate abandonment.

Workflow auditcaution

The sole workflow was fully analyzed with no untrusted checkout, injection, or high-severity findings. However, both action references are unpinned, so their moving targets create a modest reproducibility and supply-chain hygiene concern.