expo-font

Build provenancecaution

No build attestation or trusted publisher identity is provided, leaving published artifact provenance less transparent even though other repository controls are present.

Dangerous workflowscaution

Two workflows use pull_request_target, which warrants review because that trigger can expose write-capable automation to untrusted changes; however, no untrusted checkout or script-injection findings were detected.

Repo package mentioncaution

The repository name does not match expo-font and its README does not mention the package, creating some ambiguity about repository linkage; the Expo organization and the package artifact's matching native and build contents partly compensate.

Token permissionscaution

24 analyzed workflows lack top-level permissions and six declare top-level write access, which is weaker least-privilege hygiene than ideal; no read-only workflows were identified.