@zag-js/checkbox

Build provenancecaution

The release has no registry build attestation or trusted-publisher identity, leaving publication provenance less transparent than it could be.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/checkbox, so the package-to-repository link is less directly demonstrated; this is somewhat mitigated by the organization-backed monorepo context.

Repo toolingcaution

The repository uses established TypeScript and modern build tools, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was detected, reducing the project's published guidance for reporting vulnerabilities.

Workflow auditcaution

All three workflows were analyzed with no audit findings, no untrusted checkouts, and no script injection. However, 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a workflow-hygiene caution.