@sentry/core

Build provenancecaution

No build attestation or trusted-publisher identity is reported, leaving publication provenance less transparent despite the package's otherwise strong project evidence.

Workflow auditcaution

All 27 workflows were analyzed with no untrusted checkouts or script-injection findings, but 145 of 164 action references are unpinned and multiple high-confidence github-app findings report blanket installation permissions. The archived action and medium-confidence template-injection findings add hygiene concerns; the low-confidence cache findings are not decisive alone.