lighthouse

Security policycaution

The repository has no SECURITY.md policy, leaving vulnerability-reporting expectations less explicit. This is a transparency gap, but it is outweighed by active maintenance and security scanning.

Workflow auditcaution

All seven workflows were analyzed, with no untrusted checkout or script-injection paths and no top-level write permissions. However, 39 of 48 action references are unpinned and high-confidence adhoc-package findings occur in publishing; the low-confidence cache findings are only hygiene concerns.