@algolia/abtesting

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because that trigger can elevate workflow privileges, although no untrusted checkout or script-injection patterns were detected.

Repo issue activitycaution

There were no new or closed issues or pull requests and no merged pull requests in the last month, which is a modest maintenance-visibility gap, though it is offset by recent commits and frequent releases.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @algolia/abtesting, so the package-to-source relationship is less explicit; the organization-owned repository context partly offsets this because the package is plausibly part of a monorepo.

Security policycaution

The repository has no SECURITY.md or other detected security policy, reducing vulnerability-reporting transparency.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow has top-level write permissions; this is a process-hardening gap, although another workflow explicitly uses read-only permissions.