stefanak-michal/bolt

Workflow auditdanger

All eight workflows were analyzed and no untrusted checkout or script-injection paths were found, but four high-confidence findings report unpinned container images. All 16 analyzed action references are also unpinned, weakening build reproducibility and supply-chain controls.

Maintainerscaution

Only one registry account has publishing access. The repository is user-owned and recent release activity exists, but this still leaves limited publishing redundancy.

Project backingcaution

The package and repository are both owned by the same individual account, so there is no organization-backed maintenance capacity to offset the concentrated contributor base.

Repo bus factorcaution

One contributor made all commits during the last three months, concentrating current maintenance in a single person. User ownership provides no organization handoff evidence.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing a slow recent maintenance pace despite the recent release history.