spiral/cookies

Repo bus factorcaution

One contributor made 100% of the 7 commits in the last 3 months. Organization backing provides some handoff capacity, but the observed recent activity remains concentrated.

Repo commit activitycaution

The repository recorded 7 commits in the last 3 months, showing recent activity. However, all recent commits came from one active maintainer, which makes continuity more dependent on that person.

Security policycaution

The repository has no SECURITY.md policy. This is a transparency and vulnerability-reporting gap, though it is partly offset by the project's Psalm scanning and active maintenance.

Workflow auditcaution

Both workflows were analyzed successfully with no injection, untrusted-checkout, or high-confidence audit findings, and no top-level write permissions. However, both of the two action references are unpinned, leaving avoidable build-reproducibility risk.