outstand/ai

Repo bus factorcaution

All 12 recent commits came from one contributor, so maintenance depends heavily on a single person despite the repository being organization-owned.

Security policycaution

The repository has no security policy, leaving the process for reporting and handling vulnerabilities undocumented.

Workflow auditcaution

The single workflow was fully analyzed with no injection or high-severity findings, and it scopes permissions at job level. However, its only action reference is unpinned, which is a modest reproducibility and supply-chain hygiene gap.