js-tokens

Repo toolingcaution

The repository uses build and test tooling, but no security scanning tools were detected; this is a modest transparency gap rather than evidence of abandonment.

Security policycaution

No repository security policy was found, limiting documented guidance for reporting vulnerabilities and handling security issues.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous audit findings or untrusted-trigger sinks. However, all six action references are unpinned, which weakens build reproducibility and supply-chain transparency.