tapable

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recent contributor is evidenced by this signal.

Repo commit activitycaution

Only 1 commit from 1 active maintainer was recorded over the last 3 months, indicating limited current development activity for a foundational package.

Workflow auditcaution

All 4 workflows were analyzed and all action references are pinned, with no untrusted checkout or script-injection findings. However, high-confidence bot-conditions and github-app findings affect the Dependabot workflow, and three workflows use top-level write permissions; this is a meaningful workflow-hygiene caution, not a standalone severe risk.