@react-native/codegen

Repo toolingcaution

The project uses Babel, TypeScript, and npm scripts, but no security scanning tools were detected; the missing scanning is a modest process gap in an otherwise established build.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

The audit covered 30 of 36 workflows and found 108 of 117 action references unpinned, plus high-confidence template-injection findings and medium-confidence archived-action and inherited-secret findings. No untrusted checkout or script-injection sink was detected, and read-only or job-scoped permissions appear in several workflows, so this is a meaningful hygiene concern rather than a standalone severe verdict.