@reown/appkit-polyfills

Dangerous workflowscaution

One of 15 workflows uses pull_request_target, creating some workflow-risk exposure, but no analyzed workflow performs an untrusted checkout or detected script injection.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention this package, so the linkage is less transparent; this is partly explained by the package being a likely monorepo subpackage, but remains a caution.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations less transparent.

Token permissionscaution

Seven workflows lack top-level permission declarations and four declare top-level write access. This is a meaningful workflow-hardening gap, though other workflows use read-only or job-level permissions.

Version stabilitycaution

The assessed version is a stable major release and is not a prerelease, although 95% of recent versions were prereleases, which makes the release history somewhat noisy.