fast-csv

Build provenancecaution

No build attestation or trusted-publisher identity was recorded. This leaves publication provenance less transparent, although the active source repository and release notes provide compensating project evidence.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting and handling vulnerabilities, though dependency-review and Snyk scanning provide partial compensation.

Workflow auditcaution

Both analyzed workflows use top-level write permissions, which is broader than necessary and merits caution. However, all 7 action references are pinned, no untrusted checkout or script injection was found, and the audit completed fully with no findings.