motion

Build provenancecaution

No build attestation or trusted-publisher identity is reported. That leaves publication provenance less transparent, but the active repository and long release history provide compensating project evidence.

Repo toolingcaution

The project uses established build tooling including TypeScript, Rollup, esbuild, and Turbo. No security-scanning tool is reported, leaving a modest security-process gap.

Security policycaution

The linked repository has no SECURITY.md or other reported security policy. This weakens vulnerability-reporting transparency, although it does not indicate abandonment.

Workflow auditcaution

The only analyzed workflow completed without findings, has job-level permissions, and uses no untrusted checkout or injection sink. However, both of its two action references are unpinned, which reduces build reproducibility and supply-chain hygiene.