@zag-js/collapsible

Build provenancecaution

No build attestation or trusted-publisher provenance was reported, limiting verification of how the published artifact was produced.

Repo package mentioncaution

The repository name does not match the package and its README does not mention it, which creates some identity ambiguity; the organization-owned monorepo context partly offsets that concern.

Repo toolingcaution

The repository uses established TypeScript and build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, which weakens vulnerability-reporting transparency for a package intended for application integration.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a modest hygiene risk.