spiral/validation

Repo bus factorcaution

All six recent commits came from one contributor, spiralbot, giving the project a concentrated short-term bus factor. Organization backing provides some handoff capacity but does not remove the lack of a second recently active contributor.

Repo commit activitycaution

Six commits were made in the last three months, but only one maintainer was active during that period; this is active but somewhat narrow maintenance coverage.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

Both workflows were analyzed without security findings, unsafe checkouts, or script injection, and neither grants top-level write permissions. However, both of the two referenced actions are unpinned, reducing build reproducibility and supply-chain integrity.