@hey-api/spec-types

Workflow auditdanger

All eight workflows were analyzed and all action references are pinned, with no untrusted checkout or script-injection findings. However, four high-confidence github-app findings report blanket installation permissions; the low-confidence cache-poisoning findings are hygiene concerns rather than decisive evidence.

Repo issue activitycaution

Issues and pull requests are active, although 27 new issues versus 5 closed in the last month and no merged pull requests indicate backlog pressure.

Repo toolingcaution

The repository uses TypeScript, Vitest, Turbo, and npm scripts, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Version stabilitycaution

Version 0.2.0 is still before a stable major release and all recent releases are prereleases, so consumers should expect some API change risk.