tiimepdp/cdar

Repo bus factorcaution

All two recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second recent contributor is shown, leaving maintenance concentrated.

Repo commit activitycaution

Two commits were recorded in the last three months, with one active maintainer. Recent release and pull-request activity compensates for the modest commit count, but the activity base is still narrow.

Security policycaution

No repository security policy is present. This is a transparency and reporting gap, though it is not evidence that the package is unsafe by itself.

Workflow auditcaution

All three workflows were analyzed with no high-confidence audit findings or untrusted checkouts, but 12 of 13 action references are unpinned and one workflow grants top-level write permission. These are avoidable workflow-hygiene weaknesses without an observed exploit path.