k2gl/sshsig

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor concentration represents a real handoff risk.

Release historycaution

The package is young at 88 days with four releases, but releases occurred about every two days and activity is recent. The limited history still leaves less evidence of long-term maintenance.

Repo bus factorcaution

All 12 recent commits came from one contributor, leaving maintenance and review capacity concentrated in a single person without organizational backing.

Workflow auditcaution

All workflows were analyzed, but a high-confidence bot-conditions finding reports spoofable actor context in the Dependabot auto-merge workflow; that workflow also has top-level write permissions, while two of five action references are unpinned.