config

Build provenancecaution

No build attestation or trusted-publisher provenance was recorded, so consumers have less evidence about how the published artifact was produced.

Repo toolingcaution

The project uses TypeScript, webpack, and npm scripts, but no security scanning tools were detected; this is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting and response expectations undocumented.

Workflow auditcaution

The only workflow was fully analyzed with no audit findings or untrusted-trigger sinks, but all four action references are unpinned, reducing reproducibility and update integrity.