@radix-ui/react-roving-focus

Maintainerscaution

The organization-backed package has four publishing accounts, but hadihallak uses gmail.com and chancestrickland uses chance.dev rather than the primary workos.com domain; these are account-hygiene cautions, not evidence of maintenance capacity.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the package-to-repository relationship is not explicit. The monorepo structure makes a name mismatch ordinary, but the missing README mention remains a transparency caution.

Repo toolingcaution

The repository uses Vitest, Vite, TypeScript, and npm scripts, but no security-scanning tools were detected. This is a modest transparency and hygiene gap rather than a severe risk.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All four workflows were analyzed without injection or high-severity findings, and one scopes permissions at job level. However, all 8 analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.