@secretlint/profiler

Lifecycle scriptscaution

A prepublish lifecycle script is present. This is a minor release-process concern, but the package also has build provenance and active repository evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @secretlint/profiler, so package-to-repository ownership is less transparent even though the package is plausibly a monorepo subpackage.

Workflow auditcaution

All eight workflows were analyzed with no untrusted checkouts, script injection, or unpinned actions; three workflows grant top-level write access, and one high-confidence medium finding uses an archived action, creating a limited CI hygiene concern.