capell-app/record-switcher

Licensecaution

The package declares a proprietary license and provides no license file, which can restrict adoption and redistribution. This is a real legal transparency concern, but not evidence of abandonment.

Repo bus factorcaution

One contributor made 17 of 18 recent commits, creating concentration risk. The organization-owned project provides some handoff capacity, so this is a caution rather than a severe abandonment signal.

Repo toolingcaution

The project uses Composer build tooling, which fits the package ecosystem, but no security scanning tooling was detected. This is a modest process gap rather than evidence of unsafe code.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting. The gap matters, but it is partially offset by recent maintenance and active project backing.

Workflow auditcaution

The only workflow combines pull_request_target, an untrusted checkout, top-level write permissions, and two unpinned actions. The audit found no classified findings, but this combination creates a meaningful supply-chain exposure.