@pulumi/random

Repo toolingcaution

The project uses a build tool, but no security scanning tools were detected; this is a modest transparency and assurance gap, partly offset by its security policy and active workflows.

Workflow auditcaution

All 22 workflows were analyzed, but the audit found repeated high-confidence github-app findings, high-confidence template-injection findings, overprovisioned secrets, and inherited secrets; 7 of 132 action uses are unpinned. These workflow weaknesses materially lower supply-chain confidence, even though no untrusted checkout or script-injection path was detected.