lightweight-charts

Build provenancecaution

No build attestation or trusted-publisher identity was present, so consumers have less evidence connecting the published artifact to its source build.

Repo toolingcaution

The project uses TypeScript, Rollup, npm scripts, and Webpack, showing an established build process; no security scanning tools were detected, which is a modest transparency gap.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

All six workflows were analyzed with no untrusted checkout or script-injection findings, all action references were pinned, and most permissions were read-only. The high-confidence use-trusted-publishing finding and top-level write permission warrant workflow hygiene attention; the cache-poisoning findings were low confidence.