@bull-board/ui

Project backingcaution

The package is backed by its linked repository under the same @bull-board namespace, although the owner is an individual rather than an organization, so the maintainer-base signal deserves some caution.

Security policycaution

No security policy was found, leaving vulnerability-reporting guidance less transparent than ideal for a maintained package.

Workflow auditcaution

All seven workflows were analyzed, but all 32 action references are unpinned and high-confidence findings include unpinned container images; high-confidence adhoc package installs also weaken build reproducibility. The pull_request_target workflow has no untrusted checkout or script-injection finding, so these are workflow hygiene concerns rather than a severe standalone risk.