@algolia/requester-fetch

Dangerous workflowscaution

One of three workflows uses pull_request_target, which deserves workflow review, but no untrusted checkout or script-injection patterns were detected.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @algolia/requester-fetch, creating some uncertainty about package-to-repository mapping; the package's scoped namespace and organization backing partially mitigate this concern because it is plausibly a monorepo subpackage.

Security policycaution

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting expectations less transparent.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow has top-level write permissions; this increases CI privilege concerns, although one workflow is explicitly read-only and no broader workflow exploit pattern was detected.