alexispplin/sendcloud-v3

Maintainerscaution

Only one registry account has publish access. That is a real continuity concern for a user-owned project, although repository activity shows the same maintainer is currently active.

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

One contributor made all 11 commits in the last three months, creating a concentrated bus factor and increasing continuity risk for this user-owned project.

Repo popularitycaution

The repository has zero stars, forks, and watchers. This is weak supporting evidence, but popularity alone does not outweigh the package's observed maintenance activity.

Workflow auditcaution

All four workflows were analyzed with no detected audit findings or untrusted checkouts, and two workflows use read-only permissions. However, all 15 action references are unpinned and two workflows grant top-level write permissions, creating workflow reproducibility and permission-hygiene concerns.