@braintree/sanitize-url

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the otherwise transparent repository.

Repo bus factorcaution

All two recent commits came from one contributor, creating concentration risk; organization ownership provides some ability to hand maintenance off.

Repo commit activitycaution

Two commits were made in the last three months by one active maintainer, showing recent maintenance but a relatively light cadence.

Token permissionscaution

Two workflows lack top-level permissions and one declares write access, which reduces least-privilege transparency and warrants review, although the workflow risk scan found no dangerous execution patterns.