@biomejs/biome

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent despite otherwise strong maintenance evidence.

Workflow auditcaution

All 25 workflows were analyzed and action references are fully pinned, with no untrusted checkout or script-injection findings. High-confidence unpinned-tool findings and a trusted-publishing finding remain workflow hygiene concerns; the low-confidence cache findings are not independently decisive.