@amplitude/session-replay-browser

Repo package mentioncaution

The repository name differs from the package and its README does not mention the package, so package ownership is less transparent; the organization-owned monorepo context partly explains the name mismatch but not the missing README reference.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting guidance undocumented; this is a transparency gap but not evidence of abandonment.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkouts, script injection, or unpinned actions. However, three high-confidence findings report blanket GitHub App token permissions in the v2 publishing workflow, creating a real release-workflow hygiene concern.