donatj/flags

Release historycaution

The package has existed since 2013, but its latest registry release was about 20 months ago and there were no releases in the last 12 months. That slows confidence in ongoing release maintenance.

Repo bus factorcaution

All recent commits came from one contributor, leaving maintenance concentrated and increasing abandonment or handoff risk.

Security policycaution

The repository has no published security policy. This is a transparency gap, though the package's small dependency surface and other tooling reduce its practical weight.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, injection findings, or high-severity issues, but both action references are unpinned, leaving avoidable update risk.