@vue/runtime-core

Repo toolingcaution

The project uses substantial build and test tooling, including TypeScript, Rollup, Vitest, Vite, and multiple compilers; no security scanning tools were detected, a minor transparency gap.

Workflow auditcaution

All 8 workflows were analyzed with no untrusted checkout or script-injection findings and all 40 action references pinned. A high-confidence adhoc-packages finding and a high-confidence template-injection finding are workflow hygiene concerns, while the low-confidence cache findings carry little weight.