iak/keys

Project backingcaution

The repository is owned by an individual account rather than an organization, so the project has limited visible institutional backing. This is a modest concern, not evidence of abandonment by itself.

Release historycaution

The package has made only one release, with the latest release about 11 months ago, so its maintenance track record is limited. The repository remains available and was pushed recently, which partly offsets the sparse release history.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers during the past three months. That weakens evidence of active maintenance despite the recent push timestamp.

Security policycaution

No security policy was found, leaving vulnerability-reporting guidance unclear for a package intended to be integrated into applications.

Workflow auditcaution

All 12 analyzed action references are unpinned, and the audit found a high-confidence bot-conditions issue in the Dependabot auto-merge workflow. The workflows were fully analyzed and had no untrusted checkouts or script-injection findings, limiting the concern to automation hygiene and review controls.