@remotion/licensing

Repo package mentioncaution

The repository name and README do not mention this package, which creates some ownership ambiguity, although the organization-backed monorepo context makes a sub-package mismatch plausible.

Repo toolingcaution

The repository uses established build tooling including TypeScript, Turbo, npm scripts, and Vite. No security scanning tools were detected, leaving a modest transparency gap.

Security policycaution

The linked repository has no published security policy, which makes vulnerability reporting and disclosure expectations less transparent.

Workflow auditcaution

All six workflows were analyzed, but the audit reports a high-confidence template-injection finding and 61 unpinned action references across 50 uses. The pull_request_target workflow has no untrusted checkout or script-injection sink, and the low-confidence cache-poisoning finding is only hygiene.