dystcz/lunar-api-product-notifications

Repo bus factorcaution

One contributor accounts for all two recent commits, creating a concentrated maintenance path. The organization-owned project provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only two commits were recorded in the last three months, showing limited recent development activity. This lowers confidence that fixes will arrive quickly.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, which could indicate an unrelated source repository. The package README says it is a subtree split of the Dystore monorepo, partially explaining the mismatch but not eliminating the concern.

Security policycaution

The repository has no security policy. For a package handling product-notification routes and user-facing behavior, this weakens the documented path for reporting vulnerabilities.

Workflow auditcaution

The single workflow uses a pull_request_target trigger without an untrusted checkout or script injection, so the trigger is not dangerous here. Its one action reference is unpinned, which is a modest supply-chain hygiene concern.