@zag-js/hover-card

Repo toolingcaution

The repository uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling, but reports no security-scanning tools; the missing scanning is a modest transparency and hygiene gap.

Security policycaution

The linked repository has no security policy, leaving vulnerability-reporting expectations undocumented; the active organization-backed project partly offsets the concern but does not remove it.

Workflow auditcaution

All three workflows were analyzed with no injection or high-severity findings, but 8 of 9 action uses are unpinned and one workflow grants top-level write permissions, creating moderate workflow reproducibility and least-privilege concerns.