colorjs.io

Repo toolingcaution

The project uses TypeScript, Babel, Rollup, and npm build tooling, but no security-scanning tools were detected; the missing scanning is a minor transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and response expectations undocumented. Active commits and releases partly compensate, but this remains a modest governance gap.

Workflow auditcaution

Both workflows were analyzed successfully with no audit findings, no untrusted checkouts, and no script-injection paths. However, 3 of 4 action references are unpinned, which weakens build reproducibility without indicating an immediate severe risk.