@reown/appkit-wallet

Dangerous workflowscaution

One of 15 workflows uses pull_request_target, which warrants review because it can handle elevated repository context, but there are no untrusted checkouts or script-injection findings.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @reown/appkit-wallet, so the package-to-source relationship is not explicitly transparent; this may still be normal for a monorepo.

Security policycaution

The repository has no SECURITY.md or other detected security policy, leaving vulnerability-reporting guidance unclear.

Token permissionscaution

Seven workflows lack top-level permissions and four declare top-level write access, which is weaker least-privilege hygiene even though other workflows use read-only or job-level permissions.

Version stabilitycaution

Version 1.8.24 is a stable, non-prerelease release, although 95% of recent releases being prereleases indicates a fast-moving release process.