ably

Lifecycle scriptscaution

A prepare install-time script is present, adding build or install behavior that consumers should account for, but this signal alone does not indicate poor maintenance.

Security policycaution

The linked repository has no security policy file, leaving disclosure and response guidance undocumented despite otherwise active project maintenance.

Workflow auditcaution

All 11 workflows were analyzed with no untrusted checkouts or script injection, all 33 action references are pinned, and permissions are generally scoped; the only finding is a low-confidence cache-poisoning pattern, which is a limited hygiene concern.