@hapi/formula

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, leaving the release-to-source build relationship less transparent.

Repo toolingcaution

The project uses TypeScript and Vitest, but no security scanning tools were detected. This is a modest transparency and assurance gap, not evidence of abandonment.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, its one action reference is unpinned, which weakens reproducibility.