@docsearch/react

Build provenancecaution

No build attestation or staged publishing is reported, leaving publication provenance less independently verifiable despite a trusted publisher identity of circleci.

Dependency profilecaution

Nine runtime dependencies, including several substantial UI and AI-related packages, create a meaningful dependency surface, but the profile is consistent with this feature-rich React library.

Maintainerscaution

Four of five publish-access accounts use the organization domain, consistent with the organization-backed project; 8bittitan uses gmail.com, which is a minor account-hygiene concern rather than evidence of limited maintenance capacity.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response procedures.

Workflow auditcaution

The sole workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. Its one action reference is unpinned, a minor reproducibility and workflow supply-chain gap.