playwright-core

Maintainerscaution

Publishing access is primarily associated with microsoft.com and the project has organizational backing. The two gmail.com publisher accounts, pavelfeldman and yurys, are account-hygiene cautions but do not by themselves indicate limited maintenance capacity.

Repo package mentioncaution

The repository name does not match playwright-core and its README does not mention the package, creating some ambiguity about package-to-repository mapping. The package README identifies it as a Playwright component, so this is a limited caution rather than a severe concern.

Workflow auditcaution

All 21 workflows were analyzed with no untrusted checkout or script-injection findings, and all 79 action references are pinned. High-confidence github-app findings involving blanket app-token permissions and medium-confidence secrets-inherit findings are workflow hygiene concerns; the template-injection findings lack a corroborating untrusted trigger or sink.