db0

Build provenancecaution

No build attestation, trusted publisher identity, or staged publishing is present, leaving release provenance less independently verifiable than it could be.

Repo toolingcaution

The repository uses TypeScript and Vitest build tooling, but no security scanning tools were detected; the missing security automation is a genuine transparency gap.

Security policycaution

No SECURITY.md or equivalent security policy was detected, reducing clarity around vulnerability reporting and response.

Token permissionscaution

One workflow has read-only permissions and neither workflow declares top-level write permissions, but one CI workflow lacks top-level permissions entirely, leaving its token scope less explicit.

Version stabilitycaution

Version 0.4.1 is not a prerelease, but the 0.x major version signals that compatibility may still evolve and warrants care when upgrading.