@aws-lambda-powertools/commons

Repo package mentioncaution

The linked repository is a monorepo and does not match the package name or mention it in the README; the monorepo structure makes the mismatch understandable, but package ownership is less explicit to consumers.

Workflow auditcaution

All 27 workflows were analyzed, use read-only permissions, and have no unpinned actions or untrusted checkouts. High-confidence overprovisioned-secrets and secrets-inherit findings are genuine workflow-hygiene concerns, while template-injection findings lack a reported untrusted sink here.