@zag-js/radio-group

Repo package mentioncaution

The repository name differs from the package and its README does not mention @zag-js/radio-group, so package-specific ownership is less transparent; the organization-backed monorepo context partly offsets this.

Repo toolingcaution

The repository uses established TypeScript, Vite, tsup, SWC, npm, and esbuild tooling, but no security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found. This reduces disclosure transparency, although the strong maintenance and organization backing partly compensate.

Workflow auditcaution

All three workflows were analyzed without high-confidence findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating reproducibility and least-privilege concerns.