gravityforms/gravityformscli

Repo bus factorcaution

All six recent commits came from one contributor, creating a real continuity risk; organizational backing partly compensates because maintenance can potentially be handed off.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations and response guidance undocumented.

Workflow auditcaution

Both workflows were fully analyzed with no reported audit findings or untrusted checkout and script-injection patterns. However, all four action references are unpinned, which weakens build reproducibility and supply-chain hygiene; missing top-level permissions are acceptable here because no write-wide permissions were observed.