@tiptap/static-renderer

Maintainerscaution

Four of six publishing accounts use the organization domain, while _bdbch (bdbch.com) and svenadlung (ueber.io) are outside-domain accounts; this is a modest account-hygiene caution, mitigated by organization backing.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention @tiptap/static-renderer, so package ownership is less directly evidenced; this is somewhat mitigated by the organization-backed monorepo context.

Workflow auditcaution

All three workflows were analyzed with no untrusted checkout or script-injection findings, but all 19 action references are unpinned. The publish workflow also has a high-confidence template-injection finding and installs an ad hoc package; these warrant workflow review, though they do not by themselves make the package unfit.