spiral/security

Repo bus factorcaution

Recent contribution is fully concentrated in one contributor, which creates handoff risk; organization ownership provides some backing but no second active contributor is shown.

Repo commit activitycaution

Seven commits occurred in the last 3 months, showing recent work, although all activity came from one active maintainer.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less transparent.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, both of the two action references are unpinned, creating a modest reproducibility and supply-chain hygiene gap.