**Maintenance activity:** When was the last commit? Are issues being addressed? - **Community diversity:** Is the project maintained by one person or a diverse community? Bus factor analysis. - **Security practices:** Does the project have a SECURITY.md? Does it use memory-safe languages? Are there