@fast-csv/parse

Build provenancecaution

No build attestation or trusted-publisher provenance is present, so consumers have less independently verifiable evidence connecting the published artifact to its source.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting guidance unclear. Its dependency-review and Snyk tooling partially compensate for this documentation gap.

Workflow auditcaution

Both analyzed workflows grant top-level write permissions, which is broader than necessary and warrants tightening. However, all 7 action references are pinned, there are no untrusted checkouts or script injections, and the audit found no severity-rated findings.