mahocommerce/directory-data

Repo bus factorcaution

All four recent commits came from one contributor, leaving maintenance dependent on a single active person. Organization ownership provides some handoff capacity but does not remove the concentration.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All workflows were analyzed and action references are pinned, but two high-confidence findings show GitHub app tokens with blanket access to all repositories. The broad permissions are a meaningful supply-chain hygiene concern even though no untrusted checkout or script injection was found.