@sentry/rollup-plugin

Licensecaution

The artifact declares MIT but its license file is detected as BSD-3-Clause, creating a licensing mismatch that should be resolved before adoption.

Repo package mentioncaution

The linked repository neither matches the package name nor mentions it in its README, which creates some uncertainty about package ownership; the organization-backed monorepo context partly offsets that concern.

Workflow auditcaution

All 27 workflows were analyzed without failures and there are no untrusted checkouts or script-injection findings, but seven workflows have top-level write permissions and several high-confidence github-app findings report blanket app-token permissions. The many low-confidence cache findings and archived action are hygiene concerns rather than decisive risks.