vanilo/contracts

Repo bus factorcaution

All three recent commits came from one contributor, leaving maintenance dependent on a single active individual; organizational ownership provides only partial compensation because no second recent contributor is shown.

Repo commit activitycaution

There were three commits in the last three months, so the project is active, although the pace is modest for an actively maintained dependency.

Security policycaution

The repository has no security policy. This is a transparency and reporting gap, though it is not evidence of unsafe code by itself.

Workflow auditcaution

Both workflows were analyzed without high- or medium-severity findings, and the pull_request_target workflow has no untrusted checkout or script-injection sink. However, all three action references are unpinned, weakening build reproducibility.