@algolia/client-insights

Dangerous workflowscaution

One of three workflows uses pull_request_target, which deserves review because it can expose privileged workflow context, but no untrusted checkout or script-injection patterns were detected.

Repo issue activitycaution

There are 21 open issues and 3 open pull requests, but no issues or pull requests were opened or closed in the last month. This is a mild activity gap, partly offset by recent commits and frequent releases.

Repo package mentioncaution

The repository name does not match this subpackage and its README does not mention the package name, creating some ambiguity about package-to-repository mapping. However, the organization-owned monorepo structure and repository tree containing many client packages partly explain the mismatch.

Security policycaution

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting and response expectations less transparent.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow grants top-level write permissions. This is a workflow-hardening gap, although one workflow explicitly uses read-only permissions.