@vue/language-core

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts for its build and test workflow. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy. This is a transparency and vulnerability-reporting gap, though the active project and provenance provide compensating evidence for general maintenance health.

Workflow auditcaution

All 6 workflows were analyzed with no untrusted checkouts, script injection, or high- or medium-severity findings. However, all 28 action references are unpinned and the audit identified informational trusted-publishing findings, so workflow supply-chain hygiene is a minor caution.