default-browser

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the link between source and published artifact less independently verifiable. The matching repository and recent version release notes provide partial transparency but do not remove the gap.

Repo toolingcaution

No build tools or security scanning tools were detected. This is a modest transparency and automation gap, though the package is small and its repository contains a straightforward source tree.

Token permissionscaution

The only workflow lacks top-level token permissions, so its effective permissions are less explicit than recommended. No top-level write permissions were observed, limiting the severity of this gap.