spaze/security-txt

Project backingcaution

The registry namespace and repository are owned by the same individual account, so the package identity is consistent. This is individual rather than organizational backing and does not offset the single-contributor concentration.

Repo bus factorcaution

One contributor made all 52 commits in the last 3 months, giving the project a bus factor of one. Active output is reassuring, but maintenance continuity depends heavily on a single person.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, script injection, or audit findings, and no workflow has top-level write permissions. All 7 of 7 action references are unpinned, which weakens build reproducibility and makes the CI supply chain less controlled.