the-3labs-team/nova-busy-resource-field

Workflow auditdanger

The Dependabot auto-merge workflow combines a pull_request_target trigger with a high-confidence template-injection finding, creating a serious supply-chain path. All 8 action references are also unpinned, and three workflows grant top-level write access.

Release historycaution

The package has 14 releases over about 970 days, but only 1 release in the last 12 months, indicating a slow recent cadence. The latest release and its notes provide some evidence of continued maintenance.

Repo commit activitycaution

The repository recorded 0 commits and 0 active maintainers in the last three months, a meaningful maintenance warning despite 7 merged pull requests in the last month.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. Dependabot and Codacy provide some compensating security tooling, but not a response process.