@algolia/requester-browser-xhr

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because that trigger can increase CI privilege risk; however, no untrusted checkout or script-injection patterns were detected.

Repo issue activitycaution

There were no new or closed issues and no new or merged pull requests in the last month; this is a maintenance-hygiene caution, although active commits and releases provide compensating evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty that the linked repository directly documents this subpackage; the matching @algolia namespace and organization-owned monorepo context reduce but do not eliminate that concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less explicit than ideal.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow requests top-level write access; this is a governance gap, though one workflow explicitly uses read-only permissions and no broader workflow exploit indicators were found.