cronstrue

Workflow auditdanger

The publishing workflow combines a workflow_run trigger with an untrusted checkout and a high-confidence template-injection finding; it also grants top-level write access and leaves all 8 action references unpinned. The low-confidence cache-poisoning finding is secondary, but the publishing path still warrants substantial caution.

Repo toolingcaution

The project uses TypeScript, webpack, and npm scripts for builds. No security scanning tools were detected, leaving a modest process gap.

Security policycaution

No repository security policy was found. This is a transparency and response-process gap, though it is less significant than the active maintenance evidence.