nikajorjika/bog-payment

Workflow auditdanger

The audit completed for 5 workflows but found a high-confidence, high-severity bot-conditions issue in the Dependabot auto-merge workflow. All 10 analyzed action references are unpinned, and 3 workflows grant top-level write permissions; the pull_request_target trigger has no untrusted checkout or script-injection sink, so these remain workflow-hygiene concerns rather than an automatic critical verdict.

Maintainerscaution

Only one registry account has publish access, which limits publishing redundancy. The repository is user-owned rather than organization-owned, so there is no provided backing signal to compensate for that thin base.

Project backingcaution

The registry namespace and repository owner are the same individual account, so the source appears aligned with the publisher. It does not provide organizational redundancy or institutional backing.

Release historycaution

The package has 8 releases, but the latest was about 1 year 10 months ago and there were no releases in the last 12 months. That materially raises abandonment risk despite a previously regular median interval of about 9 days.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months. Although the repository is not archived, this recent inactivity weakens evidence that fixes and updates will arrive promptly.