oliverbj/cord

Dangerous workflowscaution

One workflow uses pull_request_target, which can require careful handling because it runs with elevated trust in pull-request contexts. No untrusted checkout or script-injection findings were detected, so this is a limited workflow concern rather than a severe signal.

Repo bus factorcaution

One contributor made all 8 commits in the last 3 months, leaving a low operational bus factor. The active release history partly offsets this, but succession risk remains.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Other evidence shows active maintenance, but it does not replace a disclosure process.

Token permissionscaution

Four of five workflows lack top-level permissions declarations, and one workflow declares top-level write access. This is weaker least-privilege hygiene, although no untrusted checkout or script-injection workflow was found.