horstoeko/zugferdublbridge

Dangerous workflowscaution

Six workflows were analyzed with no pull_request_target usage or script injection, but one workflow checks out untrusted content in a workflow_run context. This creates a modest CI supply-chain concern despite the otherwise clean workflow profile.

Maintainerscaution

Only one account has registry publish access. That alone is not evidence of poor project health, but combined with the repository's single active contributor it reinforces the limited maintainer base.

Project backingcaution

The registry namespace and repository owner match, and the repository is owned by the named individual rather than an organization. This supports ownership consistency but offers limited organizational backing.

Repo bus factorcaution

One contributor made all 2 commits in the last 3 months, so maintenance depends heavily on a single person. The repository is user-owned rather than organization-owned, so there is no shown organizational handoff buffer.

Repo commit activitycaution

Only 2 commits were made in the last 3 months, all by one active maintainer. This is evidence of maintenance, but the low volume leaves some concern about response capacity and development pace.