@tanstack/start-client-core

Repo package mentioncaution

The repository name does not match this package and its README does not mention the package, which creates some ownership-transparency uncertainty; the TanStack organization backing partly offsets that concern.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance less transparent than expected for a framework package.

Workflow auditcaution

All nine workflows were analyzed with no untrusted checkouts or script injection and all 33 action references pinned, but three workflows use top-level write permissions and three high-confidence low-severity findings install packages outside a lockfile.