@vueuse/metadata

Repo package mentioncaution

The repository name does not match this package and its README does not name it, which is a transparency caution under the signal rule. However, the organization-backed monorepo structure and package path make a sub-package relationship plausible.

Repo toolingcaution

The repository uses established build and test tooling, including TypeScript, Vitest, Vite, and Turbo. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no SECURITY.md or equivalent policy, which reduces transparency about vulnerability reporting and response.

Token permissionscaution

All workflows declare permissions, but two—including CI and publishing—have top-level write permissions. This is broader than a least-privilege setup, although no dangerous workflow pattern was detected.