chamber-orchestra/view-bundle

Repo bus factorcaution

All seven recent commits came from one contributor, concentrating maintenance knowledge. Organization ownership provides some handoff capacity but does not remove the current single-contributor risk.

Repo commit activitycaution

Seven commits in the last three months show recent work, although the activity is limited enough to warrant some maintenance caution.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerability reports are handled for a framework bundle.

Workflow auditcaution

Both workflows were fully audited with no high-confidence findings or untrusted-code sinks, but all four action references are unpinned and one workflow grants top-level write permissions. These are workflow hygiene and exposure concerns, not severe risks on their own.