@base44/sdk

Maintainerscaution

The package is organization-backed, and most publish-access accounts use the Wix domain, but netanelgilad and roymiloh use Gmail and maorshlomo, nirn, dolevepshtein, and yurynix use outside domains; these are account-hygiene cautions rather than evidence of limited maintenance capacity.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented; the available scanning tools partly compensate but do not replace a policy.

Workflow auditcaution

All 10 workflows were analyzed with no untrusted checkouts or script-injection sinks, and most scope permissions at job level. However, the manual publish workflow has high-confidence blanket GitHub App permissions and repeated template-injection findings, plus an archived action; these are meaningful release-workflow hygiene concerns even without a dangerous trigger pairing.