@envelop/core

Repo package mentioncaution

The linked repository name does not match @envelop/core and its README does not mention the package, so the repository-to-package relationship is not transparent despite the organization backing.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations less clear; this is a modest transparency gap rather than evidence of abandonment.

Token permissionscaution

Five of six workflows lack top-level token permissions, and the release workflow grants top-level write access; this weakens workflow hardening despite the absence of other dangerous-workflow findings.