tokenx

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 83 commits in the last three months came from one contributor, so maintenance depends entirely on a single person and has limited handoff resilience.

Repo toolingcaution

The project uses TypeScript, Vite, and npm scripts, but no security-scanning tools were detected, leaving a modest repository hygiene gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were analyzed with no untrusted checkouts or script injection, but all 12 action uses are unpinned and the release workflow installs a package outside the lockfile. The low-confidence cache finding is hygiene rather than a standalone severe risk.