remotion

Build provenancecaution

No build attestation or trusted-publisher provenance is present, leaving publication origin less verifiable. This is a transparency gap, but other maintenance evidence is strong.

Repo toolingcaution

The project uses TypeScript, Turbo, npm scripts, and Vite for its build. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting and response.

Workflow auditcaution

All six workflows were analyzed, but one high-confidence template-injection finding in changelog.yml is a material workflow risk. Cache poisoning was also reported with low confidence, and 61 of 50 analyzed action references were unpinned, weakening reproducibility.