@algolia/client-query-suggestions

Dangerous workflowscaution

One of three workflows uses pull_request_target, which creates elevated workflow-review concerns, although no untrusted checkout or script-injection patterns were detected.

Repo issue activitycaution

The repository has only 21 open issues and 3 open pull requests, but no issues or pull requests were opened, closed, or merged in the last month; this is a modest maintenance caution, partially offset by recent commits and releases.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating a transparency concern about the exact package-to-repository relationship; the package may nevertheless be a monorepo subpackage.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance and disclosure expectations less transparent.

Token permissionscaution

One workflow has top-level write permissions and another lacks top-level permissions, so workflow authorization is not uniformly least-privilege; the remaining workflow is read-only.