innmind/operating-system

Dependency profilecaution

The package declares 11 runtime dependencies, which is a meaningful dependency surface for a system abstraction library and increases transitive maintenance exposure, though the signal shows no other dependency warning.

Repo bus factorcaution

All 12 recent commits came from one contributor, creating a real continuity risk; organization ownership partly compensates because maintenance can be handed off within the project.

Repo toolingcaution

The project uses Make and Composer, but no security scanning tools were detected, leaving a modest transparency and assurance gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and response expectations less clear for a library with operating-system access.

Token permissionscaution

Three workflows omit top-level token permissions and one documentation workflow grants top-level write access, leaving CI privileges broader than necessary and increasing workflow supply-chain exposure.