justinholtweb/pigeon

Maintainerscaution

Only one account has registry publish access. That is a modest continuity concern for a user-owned project, although repository activity shows another recent contributor.

Project backingcaution

The repository is owned by the same individual namespace as the package and is user-owned rather than organization-owned. That matches the single registry maintainer and leaves less visible institutional continuity.

Repo bus factorcaution

Two contributors were active in the last three months, with the top contributor responsible for 75% of commits. The second contributor provides some continuity, but ownership remains concentrated.

Repo toolingcaution

Composer is used as a build tool, but no security scanning tool was detected. The missing scanning is a hygiene gap, not evidence of abandonment or a severe dependency risk by itself.

Security policycaution

The repository has no SECURITY.md or other detected security policy. For a messaging plugin handling guest links and attachments, that reduces vulnerability-reporting transparency.