exsolve

Build provenancecaution

The release has no attestation or trusted-publisher provenance, reducing verification of how the published artifact was built.

Repo toolingcaution

The project uses TypeScript, Vitest, and build scripts, but no security scanning tooling was detected; this is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance unclear, though active tests and maintenance provide partial compensating evidence.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkout, injection, or broad write-token issue, and all six action references are pinned. High-confidence low-severity adhoc-package findings show packages installed outside a lockfile, which is a limited workflow hygiene concern.