unifont

Repo bus factorcaution

One contributor made about 93% of the last three months' commits, which creates concentration risk. Organization backing and two additional active contributors partly compensate, but the imbalance remains a resilience concern.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less transparent despite its CodeQL scanning.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts, script injection, top-level write permissions, or unpinned action uses; read-only or job-level permissions cover the workflows. The informational trusted-publishing finding warrants only a modest hygiene caution because provenance otherwise confirms staged publishing.