create-next-app

Maintainerscaution

Two of three publishing accounts use the vercel.com domain, consistent with organizational ownership; the timer account uses gmail.com, which is a minor account-hygiene concern rather than evidence of a thin maintenance team.

Repo package mentioncaution

The linked repository name does not match create-next-app and its README does not mention the package, which creates some linkage ambiguity even though the artifact tree shows create-next-app templates.

Workflow auditcaution

All 29 workflows were analyzed with no untrusted checkouts or script injections, and only one of 134 action references is unpinned. High-confidence secrets-inherit findings and seven workflows with top-level write permissions are workflow-hygiene concerns, but the listed triggers have no dangerous sink evidence.