@testcontainers/postgresql

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent than it could be.

Repo package mentioncaution

The repository name does not match this scoped package and its README does not mention the package, creating some ambiguity about the package-to-source relationship despite the matching organization context.

Security policycaution

The repository has no published security policy, leaving reporting and response expectations undocumented.

Workflow auditcaution

All 21 analyzed action references are unpinned, and one workflow grants top-level write permissions; there are no untrusted checkouts or script injections, while the trusted-publishing finding is informational.