slub/dfgviewer

Repo package mentioncaution

The linked repository name does not exactly match the package name, and the indicator reports no package-name mention in its README. The repository otherwise appears to be the project source, but the mismatch warrants some provenance caution.

Security policycaution

The repository has no published security policy. This is a transparency gap for a maintained web-service extension, although the repository does use automated security scanning.

Workflow auditcaution

All 23 analyzed action references are unpinned, weakening build reproducibility and exposing workflows to moving dependencies. The audit found no dangerous triggers or high-severity findings, but it did identify a high-confidence low-severity ad hoc package install.