@commitlint/config-validator

Repo package mentioncaution

The repository name and README do not directly mention this package, which creates a package-identity transparency gap; the extensive monorepo file tree does show the @commitlint package family, partly reducing that concern.

Repo toolingcaution

The project uses TypeScript, Vitest, build tooling, and npm scripts, supporting a structured development process, though no security-scanning tools were detected.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear despite otherwise active maintenance.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkouts or script injection, but 20 of 25 action references are unpinned and a high-confidence audit found ad hoc package installation; one workflow also grants top-level write access.