boundwize/jsonrecast

Maintainerscaution

Only one registry account has publishing access. The organization-owned repository provides some backing, but the registry publishing path remains concentrated.

Repo bus factorcaution

All 331 recent commits came from one contributor, creating a real continuity risk. Organization ownership offers some handoff capacity, but no second active contributor is shown.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected, leaving a repository hygiene gap.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All four workflows were analyzed without high-confidence audit findings, and two use read-only permissions. However, all 16 action references are unpinned, so workflow dependencies can change without a fixed revision.