@statsig/client-core

Security policycaution

No repository security policy was found, leaving no documented channel or process for reporting vulnerabilities. This is a modest transparency gap, not evidence of abandonment.

Workflow auditcaution

All six workflows were analyzed, use no unpinned actions, and have no untrusted checkout or script-injection paths. However, two high-severity cache findings have low confidence, and two high-confidence workflows install packages outside a lockfile; one workflow also grants top-level write permissions, so workflow hygiene warrants caution.