@commitlint/to-lines

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which makes package ownership less explicit; the organization-backed monorepo context partly explains the mismatch but does not remove the transparency concern.

Repo toolingcaution

The project uses TypeScript, Vitest, and build tooling, but no repository security-scanning tools were detected; this is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations undocumented despite otherwise active maintenance.

Workflow auditcaution

All 25 analyzed action references are unpinned, and the audit found a high-confidence low-severity adhoc-package installation; one workflow also grants top-level write access, creating workflow hygiene concerns without an untrusted trigger or injection sink.