@datadog/browser-logs

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded, which limits release traceability; the active organization-backed repository and strong release activity partly compensate.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations less transparent than they could be.

Workflow auditcaution

All six workflows were analyzed, all 15 action references are pinned, and no untrusted checkout or script injection was found. One high-severity cache-poisoning finding has low confidence, while a high-confidence archived action and several top-level write permissions warrant modest workflow caution.