@zag-js/editable

Build provenancecaution

No build attestation or trusted-publisher metadata is present, leaving publication provenance less transparent despite the package's strong maintenance evidence.

Repo toolingcaution

The project uses established TypeScript and build tooling, but no security-scanning tool was detected, leaving a modest security-process gap.

Security policycaution

The repository has no published security policy, which reduces transparency for reporting and handling vulnerabilities.

Workflow auditcaution

All three workflows were analyzed with no injection sinks or audit findings, and one workflow has top-level write permissions. However, 8 of 9 action references are unpinned, weakening reproducibility and update safety.