@storybook/addon-designs

Repo toolingcaution

The project uses established build tooling, but no security scanning tools were detected; that is a modest transparency and defense-in-depth gap.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear.

Workflow auditcaution

The audit found a high-confidence blanket GitHub App token permission and a trusted-publishing workflow concern; one workflow also has top-level write permissions, and 8 of 14 action references are unpinned. The low-confidence cache finding is not material on its own.