@zag-js/core

Repo toolingcaution

The project uses established TypeScript and build tooling, but no security-scanning tools were detected; this is a modest transparency gap rather than a release-blocking concern.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear for consumers of this library.

Workflow auditcaution

All three workflows were analyzed with no dangerous sinks or audit findings, but 8 of 9 action references are unpinned and one workflow grants top-level write access, creating workflow-hygiene risk.