@stoplight/spectral-formats

Repo package mentioncaution

The repository name differs from the package name and its README does not mention the package, so the package-to-repository relationship is less transparent, although the organization and namespace align.

Repo toolingcaution

The project uses TypeScript, npm scripts, and SWC, but the collected repository tooling reports no security-scanning tools. This is a modest transparency gap, not evidence of abandonment.

Security policycaution

No SECURITY.md or other repository security policy was found, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

All six workflows were analyzed without untrusted checkout or script-injection findings, but 18 of 20 action references are unpinned and a high-confidence medium-severity secrets-inherit finding was reported; the low-severity adhoc-packages finding adds minor hygiene concern.