k2gl/dsse

Project backingcaution

The repository is owned by an individual account rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Repo bus factorcaution

All 13 recent commits came from one contributor, so maintenance continuity depends heavily on a single person.

Workflow auditcaution

All three workflows were analyzed without failures; the pull-request-target workflow has no untrusted checkout or script-injection sink, but a high-confidence bot-condition finding and two of nine unpinned action references remain workflow hygiene concerns.