darkwood/navi

Repo bus factorcaution

One contributor made all nine commits in the last three months. Organizational ownership provides some handoff capacity, but no second active contributor is visible in the collected period.

Repo commit activitycaution

The repository has nine commits in the last three months, showing ongoing activity, but all are attributable to one active maintainer.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tools were detected. That is a modest transparency and maintenance gap rather than a standalone severe concern.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although the package otherwise has an identifiable organization-owned repository.

Workflow auditcaution

The sole workflow uses pull_request_target, which is ordinary here because the audit found no untrusted checkout or script injection. However, its only action reference is unpinned, creating a small reproducibility and workflow supply-chain hygiene gap.