lendable/aggregate

Repo bus factorcaution

Only one contributor made commits in the last 3 months, with 100% of commits concentrated in that person, leaving a meaningful continuity risk.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance unclear; this is a transparency gap but not evidence of abandonment.

Workflow auditcaution

All four workflows were analyzed and had no untrusted checkouts or script injection, but one high-confidence finding reports a release workflow app token inheriting blanket installation permissions; one of seven action references is also unpinned.