@sentry/feedback

Build provenancecaution

No build attestation or trusted-publisher identity was recorded, leaving publication provenance less transparent than a verified build would provide.

Package scaffoldingcaution

The published artifact includes a README, while repository tests and a changelog are present. The README explicitly identifies this as an internal, experimental beta package that may break or be discontinued.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the collected evidence does not clearly connect this package to the linked monorepo.

Version stabilitycaution

Version 11.8.0 is a stable major release and is not a prerelease, although the package documentation still describes its API as experimental.

Workflow auditcaution

All 27 workflows were analyzed, but 145 of 159 action references are unpinned, creating a meaningful reproducibility and workflow supply-chain hygiene gap. Pull request target workflows have no untrusted checkout or script-injection findings; the many low-confidence cache findings do not independently add weight.