algoliasearch

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants workflow-review caution, but there are no detected untrusted checkouts or script-injection patterns.

Dependency profilecaution

The package has 14 runtime dependencies, largely within the Algolia client family, which is a meaningful dependency surface but coherent with the package's multi-client functionality.

Repo issue activitycaution

There were no new or closed issues and no new or merged pull requests in the last month; this is a modest activity gap, but it is outweighed by recent commits, frequent releases, and active maintainers.

Security policycaution

No SECURITY.md or equivalent security policy was found, reducing vulnerability-reporting transparency; this is a hygiene gap rather than a standalone dependency-blocking risk.

Token permissionscaution

One workflow lacks top-level permissions and the release workflow has top-level write permissions, creating some least-privilege concerns, although one workflow explicitly uses read-only permissions.