aws-crt

Build provenancecaution

No build attestation or trusted-publisher provenance is reported, leaving the origin of the published artifact less independently verifiable despite the project's active maintenance.

Repo toolingcaution

The project uses CMake, TypeScript, and webpack, but no security-scanning tools were detected. The missing scanning is a modest repository hygiene gap, not evidence of abandonment.

Workflow auditcaution

All seven workflows were analyzed with no untrusted checkouts, script injection, or audit findings, and four scope permissions at job level. However, all 25 action references are unpinned and one workflow has top-level write permissions, creating a workflow-supply-chain hygiene concern without an observed untrusted sink.