duncan3dc/bom-string

Project backingcaution

The repository is owned by the matching individual account rather than an organization, so the single-contributor concentration is a genuine continuity concern.

Release historycaution

The package has existed for more than 10 years and released once in the last 12 months, but its median release interval is nearly 2 years, indicating a slow cadence rather than abandonment.

Repo bus factorcaution

All 3 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited handoff resilience.

Security policycaution

The repository has no security policy, which reduces transparency about how vulnerabilities should be reported and handled.

Workflow auditcaution

Both workflows completed the audit with no findings and no untrusted checkout or script-injection paths, but both action references are unpinned, leaving avoidable build-integrity exposure.