mahocommerce/icons

Repo bus factorcaution

All three commits in the last 3 months came from one contributor, giving the repository a single-contributor bus factor. Organization backing provides some handoff capacity, but no second active contributor is shown.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Dependabot provides some compensating security tooling, but does not replace a published policy.

Workflow auditcaution

The audit found two high-confidence github-app findings involving blanket repository access, plus a low-severity adhoc package install. The pull_request_target trigger has no untrusted checkout or script injection, but the credential scope remains a meaningful workflow risk.