@upstash/ratelimit

Repo toolingcaution

The repository uses TypeScript, tsup, Turbo, and npm scripts for builds, but no security scanning tools were detected, leaving a modest hygiene gap.

Security policycaution

No repository security policy was found, which reduces transparency for reporting vulnerabilities, though active maintenance and npm provenance partly compensate.

Workflow auditcaution

All 20 analyzed action references are unpinned, and the audit found high-confidence secrets-inherit and ad hoc package-install findings plus trusted-publishing findings; there were no untrusted checkouts or script injections, so this is workflow caution rather than a severe release risk.