honed/form

Repo bus factorcaution

One contributor made all 2 commits in the last 3 months. Organization ownership provides some handoff capacity, but no second active contributor is evidenced in this period.

Repo commit activitycaution

The repository recorded only 2 commits in the last 3 months, showing limited recent maintenance activity. The repository was pushed recently, so this is slowing activity rather than clear abandonment.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented. This is a transparency gap, though it is not evidence of a security defect.

Version stabilitycaution

Version v0.7.0 is not a stable major release, but it is not marked as a prerelease and recent releases have not been prereleases. Expect some API evolution because the major version remains 0.

Workflow auditcaution

The audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow, while the pull-request trigger has no untrusted checkout or script-injection sink. All 12 action references are unpinned, and three workflows grant top-level write permissions, creating meaningful maintenance and supply-chain hygiene concerns.