@fast-csv/format

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable; this is a supply-chain transparency gap, but it is not evidence that the release is unsafe.

Security policycaution

The repository has no published security policy, a transparency gap for reporting vulnerabilities, though active maintenance and automated security scanning partly compensate.

Workflow auditcaution

Both workflows were fully analyzed with no findings, no untrusted checkouts or script injection, and all seven action references pinned. Both use top-level write permissions, a mild hygiene concern that is partly offset by the otherwise clean audit and absence of untrusted triggers.