@golevelup/nestjs-discovery

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This is a transparency gap, although the package has other evidence of an established release process.

Repo toolingcaution

The project uses TypeScript, Vite, and npm scripts, but no security scanning tools were detected. The missing scanning layer is a modest maintenance and security-hygiene gap.

Security policycaution

The repository has no security policy. That reduces transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All 14 analyzed action references are unpinned, which weakens workflow reproducibility. The audit found no untrusted checkouts, script injection, or other reported findings, while one workflow has top-level write permissions, so the net impact is a limited caution rather than a severe risk.