@remotion/web-renderer

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less independently verifiable despite the active source project.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @remotion/web-renderer, creating a package-to-source traceability concern even though a monorepo can legitimately contain subpackages.

Repo toolingcaution

The project uses TypeScript, Turbo, npm scripts, and Vite, but no security-scanning tools were detected, leaving a modest hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency for vulnerability reporting and response expectations.

Workflow auditcaution

All six workflows were analyzed, but one high-confidence template-injection finding warrants caution. All 61 detected action references are unpinned, while the low-confidence cache-poisoning finding is hygiene-level and the pull_request_target trigger has no untrusted checkout or script-injection sink.