@bufbuild/buf-linux-x64

Build provenancecaution

The release has no attestation or provenance record, leaving the connection between the published binaries and their build process less transparent.

Dangerous workflowscaution

One workflow contains script-injection risk and one uses pull_request_target, creating workflow hygiene concerns even though no untrusted checkout was detected.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the package-to-source relationship is not directly demonstrated by this signal.

Security policycaution

The repository has no published security policy, making vulnerability reporting and disclosure expectations less transparent.

Token permissionscaution

Six of 16 workflows lack top-level permission declarations and three declare top-level write access, so workflow privileges are not consistently minimized.