expo-structured-headers

Build provenancecaution

No build attestation or trusted-publisher provenance is available, leaving release origin less independently verifiable. This is a transparency gap, not evidence of an unhealthy project.

Dangerous workflowscaution

Two analyzed workflows use pull_request_target, which warrants review because that trigger can grant elevated trust to pull requests. However, no untrusted checkouts or script-injection findings were detected.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, creating some uncertainty about the linkage. The package is nevertheless represented in an Expo organization monorepo, which partially compensates for the mismatch.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions and six declare top-level write access, leaving workflow privilege configuration less restrictive than ideal. The available data shows no read-only workflows, so this remains a repository hygiene concern.