rectitude-open/filapress-core

Workflow auditdanger

All 12 action references are unpinned, and high-confidence findings identify spoofable bot conditions and a floating latest container image. The audit covered all four workflows with no untrusted checkout or script-injection findings, limiting but not removing the risk.

Dependency profilecaution

The release declares 27 runtime dependencies, including many integrated plugins, increasing upgrade and compatibility exposure for consumers. This is consistent with the package's role as a central integration package but still raises maintenance complexity.

Release historycaution

The package is 498 days old with 14 releases, but it has had no registry release in the last 12 months; the short 4.1-day median interval shows earlier activity rather than current maintenance.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last 3 months, which is a meaningful sign of slowed maintenance despite a recent repository push being visible elsewhere.

Security policycaution

The linked repository has no security policy, reducing transparency for vulnerability reporting. Dependabot and security-checker tooling provide some compensating security process.