expo-updates-interface

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving release-origin transparency weaker. This is a caution about traceability, not evidence that the release is unsafe.

Repo package mentioncaution

The repository name does not match the package and its README does not mention the package, so the link does not independently verify package ownership. Because this is an Expo subpackage in an organization monorepository, the mismatch is a transparency caution rather than a severe risk.

Token permissionscaution

Twenty-four analyzed workflows lack top-level permissions and six grant top-level write access, leaving CI permission hygiene uneven. The organization backing and absence of detected injection patterns provide context but do not remove this transparency concern.