honed/upload

Repo bus factorcaution

All 5 recent commits came from one contributor, creating a narrow operational dependency; organization ownership provides some ability to hand maintenance off but does not remove the concentration.

Security policycaution

The repository has no SECURITY.md or other declared security policy, leaving vulnerability reporting and response expectations less transparent.

Version stabilitycaution

This release is not a prerelease, but the package is still below 1.0, so its API stability is less established than a stable-major package.

Workflow auditcaution

The audit completed all 5 workflows and found no untrusted checkout or script injection, but all 12 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow.