@tinyhttp/content-disposition

Repo package mentioncaution

The repository name does not match the package and its README does not mention @tinyhttp/content-disposition, creating a transparency concern about the package-to-repository association. The mismatch is partly explained by the package being hosted in an organization monorepo, but the missing README mention remains cautionary.

Security policycaution

The repository has no published security policy, reducing transparency for vulnerability reporting and response.

Token permissionscaution

One workflow, the release workflow, lacks top-level token permissions, while the other has read-only permissions and none declare top-level write access; this is a limited workflow-hardening gap.