innmind/signals

Repo bus factorcaution

One contributor made 100% of the recent commits. Organization backing provides some handoff capacity, but no second active contributor is shown, so the release remains dependent on a narrow active base.

Repo commit activitycaution

The repository recorded seven commits in the last three months, showing active work rather than abandonment. However, all seven came from one active maintainer, leaving limited observed maintenance redundancy.

Security policycaution

The linked repository has no security policy. This is a transparency and response-process gap, although it is not evidence that the package is unsafe.

Workflow auditcaution

All three workflows were analyzed without untrusted checkouts or script injection, but all six action references are unpinned and two high-confidence medium-severity findings show secrets being inherited by reusable workflows. These are meaningful workflow hygiene and credential-scope concerns.