@boundaries/elements

Build provenancecaution

No build attestation or trusted publisher is recorded, so consumers have less evidence connecting the published artifact to its source and build process.

Repo bus factorcaution

One contributor made 85% of the recent commits, so maintenance is concentrated; two additional contributors remain active, partially reducing the continuity risk.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

All 29 action references are unpinned, and the audit reports a high-confidence trusted-publishing concern plus low-confidence cache-poisoning findings. There are no untrusted checkouts or script injections, which limits the severity.