joedolson/my-tickets

Licensecaution

The artifact and repository contain license files, but the manifest declares GPL-2.0-or-later while detected license text identifies GPL-3.0, creating a licensing mismatch that should be resolved before adoption.

Project backingcaution

The registry and repository are owned by the same individual account, so the concentrated contributor activity reflects a real single-person maintenance model rather than organization-backed handoff capacity.

Repo bus factorcaution

All 62 recent commits came from one contributor, so maintenance depends heavily on a single person despite the strong activity level.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed without dangerous triggers or audit findings, but all 9 action references are unpinned; one workflow scopes permissions at job level, which does not offset the reproducibility concern.