lit-html

Repo toolingcaution

The repository uses established build tools and TypeScript, but no security-scanning tools were detected. This is a modest transparency and defense-in-depth gap, not evidence of abandonment.

Workflow auditcaution

All nine workflows were analyzed, use read-only permissions, and had no detected findings or untrusted checkout/script-injection sinks. However, all 33 action references are unpinned, leaving avoidable build reproducibility and action-substitution risk.