scim-patch

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release-to-source provenance less transparent.

Dangerous workflowscaution

One workflow uses pull_request_target, which can be risky when handling untrusted pull requests, but no untrusted checkouts or script-injection patterns were detected in the analyzed workflows.

Maintainerscaution

Only one registry account has publish access. This is a genuine operational concentration concern for publishing continuity, though repository activity shows the project is currently active.

Project backingcaution

The repository is owned by an individual rather than an organization, so there is no organizational maintenance buffer to offset the concentrated contributor and publishing base.

Repo bus factorcaution

One contributor made 8 of 9 recent commits, so activity is highly concentrated; a second active contributor provides limited compensation but does not remove the maintainer-continuity concern.