@tiptap/extension-heading

Maintainerscaution

Six registry publishers include four using the project domain, while _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain accounts; organization backing and active repository contributors partly compensate, but account hygiene is a minor caution.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @tiptap/extension-heading; this is consistent with a monorepo, but the package-to-repository link is less explicit than ideal.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, and permissions are not broadly write-enabled. However, all 19 action references are unpinned, and the publish workflow has high-confidence template-injection and high-confidence ad hoc package-install findings, so workflow hygiene warrants review.