@datadog/native-appsec

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about package-to-repository linkage despite the matching DataDog organizational ownership.

Repo toolingcaution

The repository reports no security scanning tools, leaving a meaningful security-maintenance gap for a native security-related package.

Security policycaution

No SECURITY policy is present, reducing transparency about vulnerability reporting and handling.

Workflow auditcaution

All 25 analyzed action references are unpinned, and the release workflow uses an archived action with high-confidence findings. The low-confidence cache findings are not independently material, while the lack of dangerous triggers or top-level write permissions is compensating evidence.