@connectrpc/connect

Dangerous workflowscaution

One of nine workflows uses pull_request_target, which warrants review because that trigger can increase CI privilege risk. No untrusted checkouts or script-injection patterns were detected, substantially limiting the concern.

Repo bus factorcaution

The top contributor made 80% of the 20 recent commits, creating concentration risk. However, four additional contributors were active and the repository is organization-owned, so this is a caution rather than a severe maintenance risk.

Token permissionscaution

Seven workflows declare read-only permissions, but one workflow lacks top-level permissions and the publish workflow has top-level write access. This is a limited permissions-hygiene concern rather than a broad workflow failure.