webpatser/resonate-delivery

Project backingcaution

The package and repository are owned by the same individual account, so the source relationship is clear, but there is no organizational backing to offset the single-maintainer concentration.

Repo bus factorcaution

All 8 recent commits came from one contributor, so maintenance depends entirely on a single person and has limited handoff resilience.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations and response procedures unclear.

Version stabilitycaution

v0.7.0 is not a stable major release, so compatibility may still change before 1.0; it is not marked as a prerelease, which partly offsets that concern.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no reported audit findings or untrusted execution paths. However, both of its 2 action references are unpinned, weakening build reproducibility.