@remotion/player

Repo toolingcaution

The project uses TypeScript, Turbo, npm scripts, and Vite for builds, but no security-scanning tools were detected, leaving a modest transparency gap.

Security policycaution

The repository has no security policy, which reduces guidance for reporting and handling vulnerabilities, though active maintenance provides some compensation.

Workflow auditcaution

All six workflows were analyzed, but all 50 analyzed action references are reported unpinned, and a high-confidence template-injection finding appears in changelog.yml. The low-confidence cache-poisoning finding is hygiene only, and no untrusted checkout or script-injection sink was found.