@vercel/go

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates some package-to-source ambiguity; the organization-backed monorepo context partly offsets that concern.

Workflow auditcaution

All but one workflow were analyzed, but the audit reports high-confidence template-injection findings, many unpinned action references, and numerous ad hoc package installs. No untrusted checkout or script-injection sink was found, so these are workflow hygiene concerns rather than standalone severe risk.