@preact/signals

Repo toolingcaution

The project uses established build and test tooling and has an active build process, although no security-scanning tools were detected.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and disclosure expectations less explicit; the gap is a minor transparency concern rather than evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, high-severity findings, or unpinned action references. Two high-confidence low-severity findings report ad hoc package installation in the release workflow, a modest reproducibility concern.