magicsunday/xmlmapper

Project backingcaution

The repository is owned by a user rather than an organization, so the highly concentrated two-contributor activity leaves less visible maintenance redundancy.

Repo bus factorcaution

Two contributors were active, but one made 32 of 33 commits, leaving maintenance highly concentrated and creating continuity risk.

Workflow auditcaution

All 7 workflows were analyzed, use read-only permissions, and had no audit findings or untrusted checkout sinks. However, 10 of 14 action references are unpinned, weakening build reproducibility and supply-chain hygiene.