@hapi/pinpoint

Build provenancecaution

No build attestation or trusted-publisher provenance is present. This limits verification of how the published artifact was produced, though it is not evidence of abandonment.

Repo toolingcaution

The repository uses TypeScript and Vitest for build and test work. No security scanning tools were detected, which is a modest hygiene gap but is partly offset by the repository's security policy and focused, dependency-free package.

Workflow auditcaution

The only workflow was fully analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection paths. However, its single action reference is unpinned, so the workflow has a minor reproducibility and action-integrity gap.