@datadog/native-iast-taint-tracking

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent and the package could be piggy-backing on a broader project repository.

Security policycaution

No SECURITY.md policy was found, leaving vulnerability reporting and response expectations less transparent despite the repository's CodeQL and Dependabot tooling.

Workflow auditcaution

All four workflows were analyzed, scope permissions at job level, and only 3 of 66 action references are unpinned. High-confidence archived-action and ad hoc package findings are hygiene concerns; the low-confidence cache finding does not independently establish a serious risk.