@radix-ui/react-portal

Maintainerscaution

Two publish accounts use the organization's workos.com domain, but hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain accounts that create some account-continuity risk.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package. This may be normal for a monorepo, but the absence of either link creates a package-to-source transparency concern.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less transparent despite the project's active maintenance.

Workflow auditcaution

All four workflows were analyzed with no dangerous sinks or audit findings, and one scopes permissions at job level. However, all 8 action references are unpinned, so action updates are not reproducibly fixed.