@lightsparkdev/lightspark-sdk

Maintainerscaution

Two of three publishing accounts use the lightspark.com domain, but coreymartin uses a gmail.com account. With clear organization backing this is mainly account hygiene, though the outside consumer account is a minor concern.

Repo toolingcaution

The project uses build tooling, but no security-scanning tools were detected. This leaves a modest transparency gap in its maintenance controls.

Security policycaution

The repository has no documented security policy. For an SDK handling authentication tokens and financial API operations, that weakens vulnerability-reporting transparency.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts or script-injection findings. The audit did identify high-confidence template-injection hygiene findings and a low-confidence-impact adhoc package install, while six of 35 action references are unpinned; these do not by themselves indicate a severe dependency risk.