@azure/keyvault-secrets

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving the connection between source and published artifact less independently verifiable.

Dangerous workflowscaution

Eight workflows use pull_request_target, which warrants review because that trigger can expose privileged automation to pull requests; however, no untrusted checkouts or script-injection patterns were detected.

Repo toolingcaution

The repository uses TypeScript, Turbo, and npm build tooling, but no security-scanning tools were detected; the established build tooling compensates for some of this gap.

Token permissionscaution

Most workflows declare read-only permissions, but two lack top-level permissions and one has top-level write access, leaving some avoidable CI privilege exposure.