@bufbuild/protobuf

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less transparent than they could be; active maintenance partly reduces the concern but does not remove it.

Workflow auditcaution

All eight workflows were analyzed, with no untrusted checkout or script-injection sinks. However, all 38 action references are unpinned and three workflows inherit secrets, creating a meaningful workflow-hygiene caution; the low-confidence cache findings are only minor hygiene.