mutation-testing-report-schema

Security policycaution

The repository has no security policy. This is a transparency and vulnerability-reporting gap, although Dependabot scanning provides some compensating security practice.

Workflow auditcaution

All four workflows were analyzed without untrusted checkouts or script injection, but all 10 action references are unpinned and a high-confidence finding reports a GitHub App token inheriting blanket installation permissions. These are meaningful workflow hygiene and permission concerns, not evidence that the release is unfit.