@zag-js/react

Build provenancecaution

No build attestation or trusted-publisher provenance is available. This weakens publication transparency but does not outweigh the package's strong maintenance evidence.

Security policycaution

The repository has no security policy. This is a transparency gap, although the active repository and clean workflow audit provide compensating evidence.

Workflow auditcaution

All three workflows were analyzed with no reported findings, unsafe checkout, or script injection. However, 8 of 9 action references are unpinned and one workflow grants top-level write permissions, creating a moderate reproducibility and workflow-hygiene concern.