@datadog/browser-rum-core

Build provenancecaution

No build attestation or staged-publishing provenance is present, leaving publication origin less independently verifiable, but this is a transparency limitation rather than a standalone health failure.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations and response guidance less transparent.

Workflow auditcaution

All six workflows were analyzed and all action references are pinned. A high-severity cache-poisoning finding has low confidence and is hygiene-level, while the high-confidence archived action and several top-level write permissions are modest workflow risks without an untrusted checkout or script-injection sink.