@typespec/ts-http-runtime

Build provenancecaution

No build attestation, trusted publisher identity, staged publishing, or approver is recorded, leaving release-to-source transparency weaker than ideal.

Dangerous workflowscaution

Eight of 21 workflows use pull_request_target, which warrants review because that trigger can expose privileged workflow behavior, but no untrusted checkout or script-injection findings were detected.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the package-to-source linkage is less transparent; the mismatch is somewhat mitigated by the repository being an organization-owned monorepo.

Repo toolingcaution

The repository uses TypeScript and Turborepo, but no security-scanning tools were detected; build tooling is healthy while security-tooling coverage is a transparency gap.

Token permissionscaution

Most workflows declare read-only permissions, although two lack top-level permissions and one has top-level write permissions, leaving some workflow privilege configuration less restrictive than ideal.