mmedia/le-chat

Repo bus factorcaution

All three recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is evidenced.

Repo commit activitycaution

Three commits were made in the last three months by one active maintainer, which demonstrates recent work but indicates a modest maintenance pace.

Security policycaution

No repository security policy was found, leaving vulnerability reporting expectations less transparent for a package that handles chat data.

Version stabilitycaution

Version 0.4.7 is not a prerelease, although the package remains below major version 1 and may still signal API change risk.

Workflow auditcaution

All 18 action references are unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so this is workflow hygiene and supply-chain exposure rather than a severe standalone failure.