po-parser

Dangerous workflowscaution

One of three workflows uses pull_request_target, which warrants review because that trigger can expose repository privileges to untrusted pull-request content; no untrusted checkout or script injection was detected.

Repo toolingcaution

The project uses TypeScript and npm build tooling, but no security scanning tools were detected. This is a modest transparency and hardening gap rather than evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented.

Token permissionscaution

All three workflows lack top-level token permissions declarations, so their effective permissions are less explicit than ideal, although none declares top-level write access.