@rc-component/dialog

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable, though this is a transparency limitation rather than evidence of abandonment.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting expectations unclear; this is a modest transparency gap for a maintained library.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkouts, but three have top-level write permissions and five of ten action references are unpinned, creating minor workflow hygiene risk.