@sentry-internal/replay-canvas

Repo package mentioncaution

The package is published from a large monorepo whose name differs from the package and whose README does not mention it. The mismatch is consistent with a sub-package, but the missing README mention leaves some provenance ambiguity.

Workflow auditcaution

The audit covered all 27 workflows, but 145 of 164 action references are unpinned and several high-confidence findings report GitHub App tokens inheriting blanket permissions. Low-confidence cache findings and an archived action add hygiene concerns, while no untrusted checkout or script-injection sink was found.