create-sitecore-jss

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving the correspondence between source and published artifact less verifiable.

Repo toolingcaution

The repository uses TypeScript and npm build tooling, but no security scanning tools were detected; the build tooling is appropriate while the security-tooling gap modestly limits assurance.

Security policycaution

No repository security policy was found, reducing transparency about vulnerability reporting and response procedures.

Token permissionscaution

All four workflows lack top-level permissions declarations. Although none declares top-level write permissions, explicitly constraining workflow tokens would provide stronger least-privilege assurance.

Version stabilitycaution

Version 23.0.0 is a stable major release and is not a prerelease. The recent prerelease share is high at 90%, which merits some caution around the broader release stream but does not undermine this stable release on its own.