sanmai/json-serializer

Project backingcaution

The registry namespace and repository are owned by the same individual, so the package identity is clear, but there is no organization backing to offset the concentrated contributor base.

Repo bus factorcaution

All eight commits in the last three months came from one contributor, giving the project a single-person maintenance dependency and increasing continuity risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented for consumers.

Workflow auditcaution

All eight analyzed action references are unpinned, and the audit found a high-confidence template-injection issue in autoapprove.yaml; the workflow also has top-level write permissions. These are workflow hygiene and supply-chain concerns, though no untrusted checkout or script-injection sink was found.