php-coord/datapack-oceania

Licensecaution

The artifact contains a license file, but the detected MIT and CC-BY-4.0 text does not fully match the broader manifest declaration, which also lists CC-PDDC, etalab-2.0, and proprietary terms. The package is licensed, but the mismatch reduces clarity.

Project backingcaution

The repository is owned by an individual user rather than an organization, so there is no organizational backing shown to offset the concentrated contributor base.

Repo bus factorcaution

All 3 recent commits came from one contributor, leaving maintenance concentrated in a single person and increasing continuity risk.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though it is not by itself evidence of abandonment.

Workflow auditcaution

Both workflows were fully audited with no untrusted checkout, script-injection, or high-confidence audit findings, and both scope permissions at job level. However, all 7 action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.