spiral/tokenizer

Repo bus factorcaution

All 9 recent commits came from one contributor, giving the project a concentrated maintenance base. Organization ownership partly compensates by allowing maintenance handoff, but contributor diversity remains limited.

Security policycaution

No repository security policy was found. This is a transparency gap, though active releases, tests, and static analysis provide some compensating project hygiene.

Workflow auditcaution

Both analyzed workflows have no top-level permissions block and no dangerous triggers, untrusted checkouts, or audit findings. However, all 2 of 2 action references are unpinned, leaving avoidable build reproducibility and action-substitution risk.