bare-stream

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations less explicit; this is a transparency gap but not evidence of abandonment.

Workflow auditcaution

Both workflows were fully audited with no detected sinks or security findings, but all 5 action references are unpinned and one workflow has top-level write permissions, creating a moderate workflow-hygiene concern.