rc-field-form

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable than it could be. This is a transparency gap rather than evidence that the release is unsafe.

Release historycaution

The project has 163 releases over more than seven years, but only one release in the last 12 months indicates a slower registry cadence. Active repository commits partly compensate for that slowdown.

Security policycaution

No repository security policy was found, reducing transparency for vulnerability reporting and response expectations.

Workflow auditcaution

All four workflows were analyzed with no audit findings or untrusted checkout and script-injection paths. However, three workflows use top-level write permissions and four of six action references are unpinned, creating modest build-hygiene concerns without an untrusted trigger.