expo-haptics

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving the publication path less transparent than it could be. This is a transparency caution, not evidence of poor maintenance.

Repo package mentioncaution

The linked repository is the Expo monorepo rather than a repository named expo-haptics, and its README does not mention the package. The name mismatch is normal for a monorepo, but the lack of an explicit mention creates a modest transparency concern.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permission declarations and six declare top-level write access, which is weaker workflow least-privilege hygiene. This is a repository security-process caution, partly mitigated by the repository's security scanning and policy.