lerc

Build provenancecaution

No build attestation or staged publishing is provided, leaving publication provenance less transparent than it could be, though this is not evidence of abandonment by itself.

Repo toolingcaution

The project uses CMake, but no security scanning tooling was detected, leaving a modest security-process gap.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting, although active maintenance and organization backing partly compensate.

Workflow auditcaution

The single workflow was fully analyzed, uses read-only permissions, and has no untrusted checkouts or audit findings. However, all 11 action references are unpinned, creating a reproducibility and action-substitution hygiene gap.