@zag-js/dismissable

Build provenancecaution

No build attestation or trusted-publisher configuration was observed, leaving publication provenance less transparent despite the package's otherwise strong maintenance evidence.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/dismissable, creating some package-to-repository identification uncertainty; the organization-backed monorepo context partly explains the mismatch.

Repo toolingcaution

The repository uses established TypeScript and build tooling, including Vite, tsup, SWC, and esbuild; the absence of security scanning is a modest transparency gap.

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating workflow supply-chain hygiene risk.