@commitlint/message

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving release origin less verifiable despite the package's other healthy indicators.

Repo package mentioncaution

The repository name does not match this package and its README does not mention it. Although the package is in an organization-backed monorepo, the missing explicit mention weakens package-to-source traceability.

Repo toolingcaution

The project uses a build toolchain and automated tests, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Workflow auditcaution

All five workflows were analyzed with no untrusted checkout or script-injection paths, but 20 of 25 action references are unpinned, one workflow has top-level write permissions, and a high-confidence audit found an ad hoc package install.