zappzarapp/audit-logger

Release historycaution

The package is 216 days old with two releases and a median interval of about 60 days, providing some release evidence but a short track record for judging long-term maintenance.

Repo bus factorcaution

Two contributors were active in the last three months, but the leading contributor made two of three commits. That provides some continuity while leaving maintenance capacity concentrated.

Workflow auditcaution

All 18 action references are unpinned, three workflows grant top-level write access, and high-confidence findings identify spoofable bot checks, a broad app token, and template injection. The audit covered all six workflows, with no untrusted checkout or script-injection trigger found.