rapidez/postcode

Release historycaution

The package is only 30 days old with two releases, so its long-term maintenance record is still limited. The latest release was published recently, which partly offsets the maturity concern.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, though it is not by itself evidence that the package is unsafe.

Workflow auditcaution

All five workflow action references are unpinned, and two high-confidence medium-severity secrets-inherit findings pass credentials to reusable workflows. One workflow also has top-level write permissions, so CI hygiene is a real adoption concern despite no untrusted checkout or script-injection findings.