ohash

Build provenancecaution

No build attestation or trusted-publisher metadata is available, leaving publication provenance less transparent, though the coherent repository and package structure provide some compensating evidence.

Repo toolingcaution

The project uses TypeScript, npm scripts, and esbuild, showing an established build process. No security scanning tools were detected, which is a modest hygiene gap.

Security policycaution

The repository has no security policy, reducing transparency for vulnerability reporting and coordinated disclosure.

Workflow auditcaution

Both workflows were analyzed successfully, use no unpinned actions, and expose no high- or medium-severity findings. High-confidence low-severity adhoc package installation appears in both workflows, warranting only a minor hygiene concern.