@vue/language-core

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts for builds and tests, but no security-scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was detected, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

All 28 analyzed action references are unpinned, and the audit identifies high-confidence trusted-publishing usage; the workflows have no untrusted checkout or script-injection findings, so this is a hygiene concern rather than a severe workflow risk.