@commitlint/top-level

Repo package mentioncaution

The repository name does not match this package and its README does not mention it, creating a package-to-source identity concern. The organization-backed monorepo layout partly explains the mismatch but does not remove the caution.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response procedures undocumented.

Workflow auditcaution

All 5 workflows were analyzed with no high- or medium-severity findings, but 20 of 25 action references are unpinned and one workflow installs a package outside a lockfile. One workflow also has top-level write permissions, so CI reproducibility and least-privilege hygiene are imperfect.