@reown/appkit-controllers

Dangerous workflowscaution

One pull_request_target workflow exists, which warrants review because that trigger can be sensitive, but no untrusted checkout or script-injection patterns were detected across the 15 analyzed workflows.

Repo package mentioncaution

The linked repository name does not match the package and its README does not mention it, so the package-to-repository relationship is not explicit; the organization-owned monorepo context partly compensates but does not remove this transparency gap.

Security policycaution

No SECURITY.md or equivalent security policy was found, leaving vulnerability-reporting and response expectations less transparent.

Token permissionscaution

Seven workflows lack top-level permissions and four declare top-level write access, creating avoidable CI permission ambiguity despite some read-only and job-scoped controls.

Version stabilitycaution

The assessed release is a stable major-version release rather than a prerelease, although the recent prerelease share is very high and indicates a fast-moving project.