innis/nostr-relay

Project backingcaution

The repository is owned by an individual account, so the single-contributor concentration is not backed by an organization that could readily transfer maintenance.

Repo bus factorcaution

All 62 recent commits came from one contributor, creating a meaningful continuity and handoff risk despite the high commit volume. The repository is user-owned rather than organization-owned, so no organizational backing compensates for this concentration.

Repo toolingcaution

Composer build tooling is present, but no repository security-scanning tools were detected. The missing scanning is a hygiene gap rather than evidence of abandonment, especially since other repository transparency signals are present.

Version stabilitycaution

Version v0.9.0 is not a stable major release, so its API may still change. It is not marked as a prerelease, and recent releases have no prerelease share, which partly offsets the maturity concern.

Workflow auditcaution

The single workflow was fully analyzed with no trigger-to-untrusted-code findings or auditor findings. However, all three action references are unpinned, leaving the CI build exposed to mutable action changes; the absence of a top-level permissions block is acceptable here and is not a risk by itself.