react-easy-crop

Repo bus factorcaution

All 13 recent commits came from one contributor, creating a genuine continuity risk despite the repository's ongoing activity.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations less explicit; this is a minor transparency gap.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkout/script-injection sinks. However, all 13 action references are unpinned and two workflows grant top-level write permissions, creating moderate workflow hygiene concerns without a demonstrated exploit path.