k2gl/signed-note

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.

Release historycaution

The package is young at 77 days with three releases and a median interval of about 39 days. Recent publishing is active, but the short history provides limited evidence of long-term maintenance.

Repo bus factorcaution

All 10 recent commits came from one contributor, so maintenance depends heavily on a single person and has limited handoff capacity.

Workflow auditcaution

All workflows were analyzed successfully, but the audit found a high-confidence bot-conditions issue in a pull_request_target workflow; that workflow also has top-level write permissions. Two of five action references are unpinned, a minor reproducibility concern.