@redocly/respect-core

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about the linkage. The organization-owned monorepo context partly compensates, since subpackages commonly use a shared repository.

Repo toolingcaution

The repository uses TypeScript, Vitest, and npm scripts, but no security scanning tools were detected. The build tooling is sound; the missing scanning is a modest transparency gap.

Security policycaution

The repository has no security policy. This weakens vulnerability-reporting transparency, although the active organization-backed project provides some compensation.

Workflow auditcaution

All 13 workflows were analyzed with no untrusted checkouts or script-injection findings, and 109 of 111 action references are pinned. High-confidence template-injection findings in docs-tests and ad hoc package installs are workflow hygiene concerns, but they are not paired with a dangerous untrusted trigger and do not establish a release-blocking risk.