@datadog/browser-rum

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable than it could be; the active organization-backed repository partly offsets this gap.

Security policycaution

The repository has no security policy, which weakens vulnerability-reporting transparency even though CodeQL and Dependabot provide compensating security tooling.

Workflow auditcaution

All six workflows were analyzed and all 15 action references are pinned. The high-severity cache-poisoning finding has low confidence and the medium archived-action finding is hygiene; top-level write permissions are not paired with untrusted checkout or script injection.