@bull-board/express

Security policycaution

The repository has no security policy file, leaving vulnerability reporting guidance unclear. This is a transparency gap, but active security scanning partly offsets it.

Workflow auditcaution

All seven workflows were analyzed, but all 32 action references are unpinned and high-confidence findings include unpinned container images; high-confidence adhoc package installs also appear in two workflows. The pull_request_target workflow has no untrusted checkout or script-injection sink, and the cache findings are low confidence, so this is workflow hygiene risk rather than a severe dependency verdict.