expo-symbols

Build provenancecaution

No build attestation or trusted-publisher provenance is available, so consumers cannot independently verify how this release artifact was built; this is a transparency gap rather than evidence of abandonment.

Repo package mentioncaution

The repository name does not match the package and its README does not mention expo-symbols, which creates a transparency and package-alignment concern; the package tree nevertheless places the code in the linked Expo monorepo.

Token permissionscaution

24 of 30 analyzed workflows lack top-level permission declarations and six declare top-level write access, leaving workflow privilege boundaries less explicit than ideal despite no observed untrusted checkouts or script injection.