hotkeys-js

Maintainerscaution

Only one registry account has publish access, creating some operational concentration risk. This is partly mitigated by the active repository and sustained release history, but it remains a modest caution.

Repo toolingcaution

The project uses TypeScript, Vite, npm scripts, and Rollup, demonstrating an established build process, but it has no detected security-scanning tooling, leaving a security-hygiene gap.

Security policycaution

The repository has no security policy, which reduces transparency about vulnerability reporting and response procedures.

Token permissionscaution

Both workflows lack top-level permissions declarations and rely on job-level permissions only; although no workflow has top-level write permissions, explicit least-privilege declarations would provide stronger CI security hygiene.