@clickhouse/client

Maintainerscaution

Six of seven registry publishers use the clickhouse.com domain, consistent with organization ownership. The hoorayimhelping Gmail account is a minor account-hygiene caution, not evidence of limited maintenance capacity.

Security policycaution

The linked repository has no SECURITY.md policy. This is a transparency gap for vulnerability reporting, although the repository's security scanning tools partly compensate.

Workflow auditcaution

The audit found a high-confidence blanket GitHub App permission issue and medium-confidence inherited secrets, while six workflows grant top-level write permissions. There are no untrusted checkouts or script injections, but one file failed audit and the workflow surface remains a meaningful hygiene concern.