@posthog/types

Maintainerscaution

The package has 21 publish-access accounts, with 11 using the posthog.com domain and organization backing shown elsewhere. The listed outside-domain account rauln (raulnegron.me) and several consumer email accounts are account-hygiene cautions, not evidence of limited maintenance capacity.

Workflow auditcaution

All 29 workflows were analyzed, all use read-only permissions, and all 183 action references are pinned. However, six high-confidence or medium-confidence high-severity findings include spoofable bot checks, a broad GitHub App token in release.yml, and template injection; these warrant caution despite the otherwise strong controls.