concurrently

Repo toolingcaution

The project uses TypeScript, Vitest, and npm scripts for builds and tests. No security scanning tools were detected, which is a modest transparency gap but not a severe dependency risk on its own.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting and response expectations undocumented. This is a maintenance and transparency gap, but active releases and repository activity compensate partly.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, script injection, or audit findings. However, all 7 of 7 action references are unpinned, and one workflow has top-level write permissions, creating avoidable workflow-reproducibility and token-scope concerns.