voku/anti-xss

Project backingcaution

The registry namespace and repository are owned by the same individual account, so there is no organizational backing shown to offset the concentrated contributor activity.

Repo bus factorcaution

Although two contributors were active, one contributor made 51 of 52 recent commits, leaving maintenance highly concentrated and increasing continuity risk.

Security policycaution

No repository security policy was found. For a package focused on filtering XSS, the absence of a documented vulnerability-reporting process is a transparency gap.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and pins all seven action references. However, it contains three high-confidence template-injection findings; template injection alone is a workflow-hygiene concern rather than evidence of an untrusted checkout or dangerous trigger.