innmind/immutable

Repo bus factorcaution

All nine recent commits came from one contributor, leaving a thin operational base; organizational ownership provides some handoff capacity but no second active contributor is shown.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear for a library used by downstream projects.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout or script-injection findings, but all seven action references are unpinned and three workflows inherit secrets with high-confidence medium-severity findings; one workflow also grants top-level write access.