metro-minify-terser

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. Because this package may not be explicitly identified in the linked repository, source ownership is less transparent than ideal.

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, although active maintenance and automated dependency scanning provide some compensating evidence.

Token permissionscaution

Three workflows declare read-only permissions, while one workflow lacks top-level permissions; none declares top-level write access. The single omission is a modest workflow-hygiene concern, not a severe risk.