@rc-component/qrcode

Build provenancecaution

No build attestation or trusted-publisher identity is provided, leaving publication provenance less transparent. This is a supply-chain transparency gap, but not evidence that the release is unsafe.

Security policycaution

The repository has no security policy, so users have no clearly documented channel or process for reporting vulnerabilities. This is a modest transparency gap.

Workflow auditcaution

All five workflows were analyzed with no audit findings or untrusted checkout and script-injection paths. However, three workflows grant top-level write access and five of ten action references are unpinned, reducing workflow hardening.