@zag-js/popper

Repo toolingcaution

The project uses established TypeScript and build tooling, but no security scanning tools were detected; this is a minor transparency gap rather than a dependency blocker.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unspecified; active repository and release activity partly offset this documentation gap.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions, weakening reproducibility and least-privilege hygiene.