juniora/tokenizer-x

Release historycaution

This is a young package with one release over 163 days and no established release cadence, so long-term maintenance remains unproven.

Repo commit activitycaution

There were zero commits and zero active maintainers in the last three months, which is a meaningful maintenance concern for a package only 163 days old.

Repository archivedcaution

The repository is active rather than archived, but its last push was on the release date, so this does not demonstrate continuing maintenance.

Security policycaution

No security policy is present, leaving vulnerability-reporting expectations unclear; this is a minor transparency gap rather than evidence of abandonment.

Workflow auditcaution

All 12 action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow; top-level write permissions across three workflows add avoidable exposure, though no untrusted checkout or script injection was found.