@electric-sql/client

Dangerous workflowscaution

One of 30 analyzed workflows uses pull_request_target, which carries elevated workflow review risk; no untrusted checkouts or script-injection patterns were detected, limiting the concern.

Repo toolingcaution

TypeScript and npm build tooling are present, but no security-scanning tools were detected. This is a genuine security-hygiene gap, though it does not by itself establish that the release is unsafe.

Token permissionscaution

Fourteen workflows lack top-level permissions and 10 declare top-level write access, increasing CI token-scope review requirements. Six workflows explicitly use read-only permissions, so this is a hygiene concern rather than a severe standalone risk.