@rc-component/mini-decimal

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving publication origin less independently verifiable despite the otherwise established project history.

Security policycaution

The repository has no published security policy, which makes vulnerability reporting and response expectations less transparent.

Workflow auditcaution

All four workflows were analyzed with no audit findings or untrusted sinks, but two workflows grant top-level write permissions and five of ten action references are unpinned, creating moderate workflow hygiene concerns.