@tanstack/start-plugin-core

Repo package mentioncaution

The repository name does not match the package and its README does not mention this package. Although a monorepo mismatch is ordinary, the absence of both a name match and README mention leaves a modest package-to-repository transparency concern.

Security policycaution

No repository security policy was found. This is a transparency gap, though active maintenance and automated security scanning partly reduce its significance.

Workflow auditcaution

All nine workflows were analyzed with no high- or medium-severity findings, no untrusted checkout or script-injection paths, and all 33 action references pinned. Three high-confidence low-severity findings install packages outside a lockfile, and three workflows grant top-level write access, so workflow hygiene is not perfect.