ahmedde/unit-conversion

Release historycaution

Only one release exists, published 202 days ago, so there is little release history to establish sustained maintenance.

Repo bus factorcaution

All recent commits come from one contributor, leaving no demonstrated backup maintainer and increasing continuity risk for a user-owned project.

Repo commit activitycaution

The repository recorded one commit in the last three months from one active maintainer; recent activity exists, but the pace is too thin to demonstrate sustained maintenance.

Security policycaution

No repository security policy was found, so consumers have no documented channel for reporting vulnerabilities or receiving coordinated fixes.

Workflow auditcaution

All four workflows were analyzed, but every action reference is unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so these are workflow hygiene concerns rather than a severe standalone risk.