metro-cache

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent than it should be. A monorepo can explain the name mismatch, but the absence of any README mention remains a caution.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear. Its active maintenance and Dependabot scanning help, but do not replace a documented disclosure process.

Token permissionscaution

Three workflows declare read-only permissions, while one workflow has no top-level permissions declaration. No workflow requests top-level write access, so this is a limited workflow-hygiene gap.