soderlind/vmfa-folder-exporter

Maintainerscaution

Only one registry account has publish access, which creates publishing concentration, though the linked repository shows the same individual actively maintaining it.

Project backingcaution

The repository is owned by an individual rather than an organization, so the single-contributor and single-publisher concentration is not offset by visible organizational backing.

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance dependent on a single active developer.

Security policycaution

The repository has no documented security policy, leaving vulnerability-reporting and response expectations unclear.

Workflow auditcaution

Both workflows were fully analyzed with job-level permissions and no untrusted checkout or script-injection findings. Four of eight action references are unpinned, and the auditor reported only low-confidence cache-poisoning hygiene findings, so this is a minor caution rather than a severe workflow risk.