happytodev/blogr

Maintainerscaution

Only one registry account has publish access. This is consistent with the user-owned repository but leaves little publishing redundancy, especially alongside the repository's single active contributor.

Project backingcaution

The registry namespace and repository are owned by the same individual account rather than an organization. This matches the single-contributor evidence and means there is no organizational handoff capacity to offset the bus-factor concern.

Repo bus factorcaution

One contributor made all 20 commits in the last three months, giving the project a single-person bus factor and increasing abandonment or interruption risk.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkouts or script injection. All five action references are unpinned, and a high-confidence low-severity finding reports an ad hoc package installation outside a lockfile, creating a minor CI supply-chain hygiene concern.