moonspot/phlag-client

Maintainerscaution

Only one registry publishing account is listed, which is a modest publishing-bus-factor concern, but repository activity shows a second active contributor.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single registry maintainer and small contributor base represent a real continuity consideration.

Repo popularitycaution

The repository has no stars, forks, or watchers, so it has little visible community adoption; this is supporting evidence only and is outweighed by active releases and commits.

Security policycaution

The repository has no security policy, leaving vulnerability reporting expectations unclear; the small, actively maintained project provides some compensation but does not remove the transparency gap.

Token permissionscaution

The CI workflow lacks top-level token permissions, so its effective permissions are less explicit than recommended, although no write permissions were detected.