cronstrue

Repo toolingcaution

The project uses webpack, TypeScript, and npm scripts for builds, but no security-scanning tool was detected; the missing scanner is a modest transparency gap.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations undocumented.

Workflow auditcaution

Both workflows were analyzed, but the publishing workflow combines a workflow_run trigger with an untrusted checkout and a high-confidence template-injection finding; all 8 action references are unpinned. The cache-poisoning finding is low confidence, so it adds only limited weight.