@zag-js/rating-group

Repo toolingcaution

The project uses established TypeScript and build tooling, but no security-scanning tools were detected; this is a modest transparency gap rather than a dependency blocker.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less explicit. This is a minor transparency concern for an otherwise active project.

Workflow auditcaution

All three workflows were analyzed without detected audit findings or untrusted checkout paths, but 8 of 9 action references are unpinned and one workflow grants top-level write permission. Without an untrusted trigger or sink, this remains a workflow-hygiene caution rather than a severe risk.