@tanstack/react-devtools

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting guidance undocumented; this is a transparency gap, not evidence of unsafe code.

Version stabilitycaution

This is a non-prerelease 0.x release, but the package explicitly warns that it remains under active development and may introduce breaking changes.

Workflow auditcaution

All 9 workflows were analyzed, use 29 pinned action references, and mostly use read-only permissions. Two high-confidence adhoc-package findings are hygiene concerns, while the cache-poisoning finding has low confidence and carries limited weight.