@redocly/respect-core

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @redocly/respect-core, so the package-to-repository relationship is less transparent. The organization-backed monorepo context partly offsets this, but the gap remains worth checking.

Repo toolingcaution

The repository uses TypeScript, Vitest, and npm scripts, but no security scanning tools were detected. The build and test tooling is solid; the missing security tooling is a modest transparency gap.

Security policycaution

The repository has no security policy. This does not show unsafe code, but it leaves vulnerability reporting and disclosure expectations less clear.

Workflow auditcaution

All 13 workflows were analyzed with no high- or medium-severity findings and no untrusted checkout or script-injection sinks. Three high-confidence low-severity adhoc-package findings and two unpinned actions are minor workflow hygiene concerns.