@rc-component/context

Build provenancecaution

No build attestation or trusted-publisher provenance is recorded. This is a transparency gap, but it is moderated by the linked repository and release notes for the assessed version.

Security policycaution

The repository has no published security policy. This is a minor transparency gap for reporting vulnerabilities, without evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no reported audit findings or untrusted checkouts, but two workflows grant top-level write permissions and four of six action references are unpinned. These are modest workflow hygiene risks rather than severe exposure.