@algolia/autocomplete-core

Lifecycle scriptscaution

A prepare script runs during installation or package preparation. This is a small operational consideration, but the signal provides no evidence that it is unsafe or unusually complex.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and response expectations, though active maintenance and security scanning partly offset the gap.

Workflow auditcaution

All four workflows were analyzed, but all 27 action references are unpinned, two workflows have top-level write permissions, and two high-confidence findings report blanket GitHub App token permissions; an additional workflow installs a package outside a lockfile.