@algolia/client-analytics

Dangerous workflowscaution

One of three workflows uses pull_request_target, which deserves review because it can elevate workflow privileges; however, no untrusted checkout or script-injection patterns were detected.

Repo issue activitycaution

The repository has only 21 open issues and 3 open pull requests, but no issues or pull requests were opened or closed in the last month; this is a modest activity gap, partially offset by recent commits and frequent releases.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @algolia/client-analytics, creating some uncertainty that the linked repository directly corresponds to this package rather than only serving as a monorepo source; the package's scoped organization ownership and matching repository tree provide partial context but do not remove the gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and disclosure expectations less transparent.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow declares write permissions; these are operational risks, though write access in a release workflow can be expected and no broader workflow compromise was observed.