arnoson/kirby-vite

Repo bus factorcaution

One contributor made all commits in the last three months, leaving maintenance highly concentrated. The repository is user-owned rather than organization-owned, so there is no provided organizational backing to compensate for that concentration.

Repo commit activitycaution

Only one commit was recorded in the last three months, indicating limited recent development activity. The recent release and repository push provide some evidence of continued maintenance, but do not offset the thin activity entirely.

Security policycaution

The linked repository has no SECURITY.md or other declared security policy. This weakens vulnerability-reporting transparency, although it does not by itself show abandonment.

Workflow auditcaution

All four analyzed action references are unpinned and one workflow grants top-level write permissions, creating workflow hygiene concerns. The only cache-poisoning finding is low confidence, so it is treated as hygiene rather than a severe risk; the audit itself completed for both workflows.