stickee/canary

Release historycaution

The project has released 22 versions over roughly four years and released within the assessment period, but only one release appeared in the last 12 months, indicating a slower cadence.

Repo bus factorcaution

All recent commits came from one contributor, concentrating short-term maintenance responsibility; organization ownership provides some handoff capacity but does not remove the concentration.

Repo commit activitycaution

There were two commits in the last three months and one active maintainer, showing recent activity but a relatively light public maintenance pace.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response guidance unclear.

Workflow auditcaution

The sole workflow audit completed cleanly with no dangerous triggers, injection findings, or high-confidence audit issues. However, both analyzed action references are unpinned, which weakens build reproducibility, while the absence of a top-level permissions block is acceptable on its own.