@fullcalendar/react

Build provenancecaution

No build attestation or trusted-publisher provenance is present, which is a transparency gap, but it is not severe enough to outweigh the active project evidence.

Repo toolingcaution

The project uses TypeScript, Turbo, and npm scripts for builds, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, sinks, or audit findings, but all four action references are unpinned. Missing top-level permissions are acceptable here and are not a finding.