lendable/clock

Repo bus factorcaution

All 3 recent commits came from one contributor, creating a real continuity risk; organization ownership provides some capacity to hand off maintenance but no second active contributor is shown.

Repo commit activitycaution

The repository had 3 commits in the last 3 months, showing activity but not a broad or sustained development pace on its own.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting; this is a hygiene gap rather than evidence that the package is unsafe.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkout or script injection, but the release workflow has a high-confidence github-app finding because its app token inherits blanket installation permissions; one of seven action references is unpinned.