@hookform/resolvers

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the connection between source and published artifact less independently verifiable.

Repo toolingcaution

The repository uses TypeScript, Vitest, Microbundle, npm scripts, and Vite, showing an established build and test toolchain. No security scanning tools were detected, leaving a modest security-process gap.

Token permissionscaution

All three workflows lack top-level token permissions declarations, so their default permissions are less explicit than ideal. None declares top-level write access, which limits the severity of this concern.