@cypress/code-coverage

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, a meaningful maintenance warning even though a recent package release exists.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All seven analyzed action references are unpinned, and two high-confidence medium-severity findings expose inherited secrets; a separate workflow installs a package outside a lockfile. The pull_request_target trigger has no untrusted checkout or script-injection sink, so it is not independently severe.