@docsearch/css

Build provenancecaution

No build attestation or staged publishing is present, leaving the artifact-to-source chain less independently verifiable despite the trusted publisher identifier being recorded.

Maintainerscaution

Four of five publish-access accounts use the Algolia domain, consistent with the organization-backed repository; the one consumer-domain account, 8bittitan, is an account-hygiene caution rather than evidence of limited maintenance capacity.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response.

Workflow auditcaution

The sole workflow had no dangerous triggers, untrusted checkouts, or audit findings, but its one action reference is unpinned and the workflow lacks a top-level permissions block.