andriichuk/pushbox

Release historycaution

This is a young package with one release over about five months and no established release cadence, so its long-term maintenance record is limited.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, which is a meaningful warning for a project with only one published release.

Security policycaution

The repository has no security policy, leaving reporting and response expectations undocumented; this is a transparency gap, though not by itself evidence of abandonment.

Workflow auditcaution

All 12 analyzed action references are unpinned, three workflows grant top-level write access, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, which limits the severity.