@amplitude/session-replay-browser

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, which is a caution because the linkage is less explicit; the organization-owned monorepo context partly explains the mismatch.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent than it could be.

Workflow auditcaution

All 11 workflows were analyzed, with no untrusted checkouts, script injection, or unpinned action references. However, three high-confidence findings report blanket GitHub App token permissions in the v2 publish workflow, creating a meaningful release-workflow hygiene concern.