@zag-js/pagination

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the connection between the published artifact and its build less transparent.

Repo toolingcaution

The repository uses established TypeScript and build tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, which makes vulnerability reporting and disclosure expectations less transparent.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkout and script-injection paths. However, eight of nine action references are unpinned, and one workflow has top-level write permissions, creating a workflow hygiene concern.