@ag-ui/core

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations less clear for consumers.

Workflow auditcaution

All 28 workflows were analyzed with no untrusted checkouts or script injection and all 203 action references pinned. One archived action and one ad hoc package install are hygiene concerns; the trusted-publishing finding is also a workflow caution, though most workflows use read-only permissions.