ivanwilliammd/satusehat-integration

Dependency profilecaution

Eight runtime dependencies create a meaningful dependency surface, including framework, HTTP, cryptographic, and environment-loading components. This is reasonable for the package's stated integration scope but modestly increases maintenance and transitive-risk burden.

Maintainerscaution

Only one registry account has publish access. This is a modest publishing continuity concern, although registry access counts do not establish who actively maintains the project.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organization-level maintenance handoff evidence to offset the concentrated contributor base.

Repo bus factorcaution

One contributor made all 49 commits in the last 3 months, producing a 100% top-contributor share and a low bus factor. This creates real abandonment and handoff risk despite the current high activity.

Token permissionscaution

Two workflows omit top-level permissions and three declare top-level write permissions, leaving a broader-than-ideal GitHub Actions token posture. This is a workflow-hardening gap, though no related dangerous checkout or injection behavior was observed.