dodopayments/client

Repo bus factorcaution

All recent commits come from one contributor, creating concentration risk; organization ownership provides some ability to hand maintenance off, so this is caution rather than a severe standalone risk.

Repo commit activitycaution

Only one commit was recorded in the last three months, with one active maintainer; this is a meaningful maintenance-capacity concern even though registry releases remain frequent.

Workflow auditcaution

All four workflows were analyzed, references are fully pinned, and no untrusted checkout or script injection was found. However, a high-confidence audit finding reports that the release workflow's GitHub App token inherits blanket installation permissions, creating a workflow-permission hygiene concern.