xml-crypto

Lifecycle scriptscaution

A prepare script runs during installation, adding build or install behavior that consumers should understand, but this signal alone does not show harmful or unnecessary activity.

Repo bus factorcaution

Six contributors were active, but one contributor made 42 of 49 commits, concentrating recent maintenance and creating a meaningful continuity risk.

Security policycaution

The repository has no security policy file, leaving vulnerability-reporting expectations less transparent despite its CodeQL and Dependabot tooling.

Workflow auditcaution

Both workflows were analyzed with no audit findings or untrusted checkouts, and permissions are scoped or read-only; however, all nine action references are unpinned, weakening build reproducibility.