pg-query-stream

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear. This is a transparency gap, but active maintenance and Dependabot partly offset the concern.

Workflow auditcaution

Both workflows use read-only permissions and the audit found no dangerous triggers, untrusted checkouts, script injection, or other findings. However, all nine action references are unpinned, leaving avoidable workflow supply-chain exposure.