paulo-hortelan/signum

Maintainerscaution

One registry maintainer is consistent with a user-owned project, but it leaves little visible publishing redundancy, especially alongside the lack of recent repository activity.

Release historycaution

Only two releases exist over roughly four months, with both released about a day apart. This shows the project is new and provides limited evidence of sustained maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months. For a package only about four months old, that is a meaningful warning about ongoing maintenance.

Security policycaution

The repository has no security policy. This is a transparency gap for a package handling certificate signing and private-key configuration, though it is not evidence of unsafe code by itself.

Workflow auditcaution

All six action references are unpinned, and the audit found a high-confidence bot-condition issue in the Dependabot auto-merge workflow. Two workflows also grant top-level write permissions, which is a milder concern because no untrusted checkout or script-injection sink was found.