watheqalshowaiter/model-fields

Dangerous workflowscaution

One of four workflows uses pull_request_target, which warrants care because that trigger can expose privileged workflow context to pull requests. No untrusted checkout or script-injection patterns were detected, limiting the concern.

Maintainerscaution

Only one registry account has publish access. This is not a health verdict by itself, but it leaves publishing continuity dependent on a single person.

Project backingcaution

The registry namespace and repository are owned by the same individual, confirming a directly backed project. Because the owner type is a user rather than an organization, continuity remains dependent on that maintainer.

Repo bus factorcaution

One contributor made all 7 commits in the last 3 months, creating a real continuity risk. The linked repository is user-owned rather than organization-owned, so there is no provided organizational backing to offset this concentration.

Repo commit activitycaution

The repository received 7 commits in the last 3 months, showing recent work, but all activity came from one active maintainer.