capell-app/notes

Workflow auditdanger

The sole workflow combines pull_request_target, an untrusted checkout, top-level write permissions, and two unpinned actions. Because these conditions occur in the same workflow, they create a material supply-chain exposure.

Release historycaution

The package is only 2 days old, despite 40 releases, so its long-term maintenance record is not yet established.

Repo bus factorcaution

One contributor made all recent commits, creating a concentrated maintenance path. Organization ownership offers some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

There was one commit in the last 3 months, showing recent activity but too little history to demonstrate sustained maintenance.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest repository-hygiene gap.