@toon-format/toon

Repo toolingcaution

The project uses TypeScript, npm scripts, and Vite with a defined build tool. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy. This reduces disclosure transparency, although the active project and other release controls provide some compensation.

Workflow auditcaution

All 4 workflows were analyzed without untrusted checkouts or script injection, and most use read-only or job-level permissions. However, all 10 action references are unpinned and two high-confidence low-severity adhoc-package findings remain; the low-confidence cache-poisoning finding is hygiene only.