@fontsource-variable/inter

Repo package mentioncaution

The linked repository name does not match this package and its README does not mention the package, so package-to-repository ownership is less transparent; the monorepo-style layout partly explains the mismatch but does not remove the concern.

Security policycaution

No SECURITY.md policy was found, leaving vulnerability reporting and response expectations less explicit.

Workflow auditcaution

All eight workflows were analyzed with no untrusted checkout or script-injection findings, but all 19 action references are unpinned and five workflows grant top-level write permissions. Without an untrusted trigger these are hygiene concerns rather than severe risks.