metro-runtime

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the linkage is less transparent. The name mismatch could be normal for a monorepo, but the lack of a README mention remains a caution.

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting vulnerabilities, although active maintenance and security scanning provide some compensating evidence.

Token permissionscaution

Three workflows declare read-only permissions and none declare top-level write access; one workflow lacks top-level permissions, leaving a modest permissions-hygiene gap.