@storybook/manager

Build provenancecaution

No build attestation or staged-publishing provenance is available, which is a transparency limitation, but it is not enough to outweigh the active project evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, creating a linkage-transparency concern; the organization-backed monorepo context partly compensates.

Workflow auditcaution

All 19 workflows were analyzed, all 46 action references are pinned, and no untrusted checkout or script injection was found. Two high-confidence low-severity adhoc-package findings are minor workflow hygiene concerns.