@sentry/vercel-edge

Build provenancecaution

No build attestation or trusted-publisher identity is present, leaving publication provenance less transparent than it could be despite the package's active project backing.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, so the package-to-repository relationship is less transparent; the monorepo context partly explains the name mismatch but not the missing mention.

Workflow auditcaution

All 27 workflows were analyzed with no untrusted checkouts or script-injection findings, but 145 of 164 action references are unpinned and high-confidence github-app findings show broadly inherited app permissions. Low-confidence cache findings and an archived action add hygiene concerns.