@preact/signals-core

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, creating some uncertainty about package-to-repository mapping despite the linked repository being organization-owned and clearly related to Signals.

Repo toolingcaution

The repository uses established build and test tooling, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and handling.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkouts, script injection, or unpinned action references. Two high-confidence low-severity adhoc-package findings in the release workflow are a minor reproducibility concern.