@zag-js/focus-trap

Repo toolingcaution

The project uses established TypeScript and build tooling, but no security-scanning tools were detected, leaving a modest transparency gap.

Security policycaution

No repository security policy was found. This is a documentation gap, but active releases and repository work provide meaningful compensating evidence.

Workflow auditcaution

All three workflows were analyzed with no injection or high-severity findings, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a moderate workflow-hygiene concern.