@zag-js/tags-input

Build provenancecaution

No build attestation or trusted-publisher identity is recorded, leaving publication provenance less transparent despite the package's active release history.

Repo package mentioncaution

The repository name does not match the package and its README does not mention @zag-js/tags-input, so package-to-repository ownership is less directly transparent; this may reflect a monorepo subpackage.

Repo toolingcaution

The repository uses established TypeScript and build tooling, but no security scanning tools were detected, leaving a modest process gap.

Security policycaution

No repository security policy was found, reducing transparency about how users should report vulnerabilities.

Workflow auditcaution

All three workflows were analyzed with no audit findings or untrusted checkouts, but 8 of 9 action references are unpinned and one workflow grants top-level write permissions; these are workflow hygiene concerns, not severe risks on their own.