strtok3

Project backingcaution

The repository owner is an individual, so there is no organization backing shown to offset the concentrated contributor activity.

Repo bus factorcaution

One contributor made all 6 commits in the last 3 months, creating a meaningful continuity risk; the repository is owned by an individual rather than an organization that could more readily transfer maintenance.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent despite its security scanning tools.

Workflow auditcaution

All 24 analyzed action references are unpinned, and one high-confidence low-severity finding reports installing a package outside a lockfile. A pull_request_target workflow has no untrusted checkout or script-injection sink, so this is workflow hygiene risk rather than a severe exposure.