tldts-core

Repo bus factorcaution

All 30 recent commits came from one contributor, leaving maintenance dependent on a single active developer and creating a genuine continuity risk.

Repo package mentioncaution

The repository name does not match tldts-core and its README does not mention the package, so the linkage is less transparent; the repository tree does contain the package directory, which partly compensates.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed without dangerous triggers, untrusted checkouts, script injection, or audit findings, but all nine action references are unpinned. The absence of top-level permissions is not concerning here because one workflow scopes permissions at job level and none grants top-level write access.