@tanstack/react-start

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates a small linkage-transparency concern; the organization-backed monorepo context partly explains the mismatch.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent than ideal despite the repository's active maintenance and security scanning.

Workflow auditcaution

All nine workflows were analyzed with no untrusted checkout or script-injection findings, all 33 action references are pinned, and six workflows use read-only permissions. Three high-confidence low-severity findings install packages outside a lockfile, and three workflows have top-level write permissions, so this is minor hygiene debt.