@commitlint/config-conventional

Build provenancecaution

The release has no build attestation or trusted-publisher provenance. This is a supply-chain transparency gap, but it is not evidence that the release is unsafe by itself.

Repo toolingcaution

The repository uses TypeScript, Vitest, npm scripts, Vite, and SWC, providing an established build and test toolchain. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was detected. This reduces transparency about vulnerability reporting and response, although active maintenance provides some compensation.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, but 20 of 25 action uses are unpinned, one workflow has top-level write permissions, and a high-confidence low-severity finding reports an ad hoc package install. These are workflow hygiene concerns rather than severe risks on their own.