@radix-ui/react-use-controllable-state

Maintainerscaution

Two publish accounts use the workos.com domain, but hadihallak (gmail.com) and chancestrickland (chance.dev) are outside-domain publishing identities, creating account-hygiene caution despite organizational backing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package; this is somewhat mitigated by the repository being an organization-backed monorepo, but package ownership is less explicit.

Repo toolingcaution

The repository uses established build tools and TypeScript, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All four workflows were analyzed without high-confidence audit findings or untrusted triggers, but all 8 action references are unpinned, which weakens build reproducibility and action supply-chain hygiene.