react-native-permissions

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational succession signal. However, recent activity from two contributors and the package's sustained release record provide meaningful compensating evidence.

Repo bus factorcaution

One contributor made 8 of 9 recent commits, so contribution activity is concentrated. A second contributor remains active, which partly offsets but does not eliminate the continuity risk for an individually owned project.

Repo toolingcaution

The repository uses TypeScript, npm scripts, and Babel for builds, but no security scanning tools were detected. The established build tooling is positive, while the missing scanning is a modest transparency gap.

Security policycaution

No SECURITY.md or equivalent security policy was found. This weakens vulnerability-reporting transparency, although the active repository and long release history compensate for some of the concern.

Token permissionscaution

The single analyzed workflow has no top-level token permissions declaration. No write permissions were detected, but explicitly limiting workflow permissions would provide stronger CI hardening.