spiral/stempler

Repo bus factorcaution

All 9 commits in the last three months came from one contributor, creating a concentrated maintenance risk. The organization-owned repository provides some ability to hand maintenance off, so this is a caution rather than a severe risk.

Security policycaution

No security policy was found in the repository, which is a transparency gap for reporting vulnerabilities, but it is not evidence of abandonment by itself.

Workflow auditcaution

Both workflows were analyzed with no dangerous audit findings, unsafe checkout, or script injection. However, both action references are unpinned, leaving a modest reproducibility and action-integrity gap; missing top-level permissions blocks are not concerning here because neither workflow requests top-level write access.