remove-markdown

Security policycaution

The repository has no security policy. This is a transparency gap for reporting vulnerabilities, though the active project and small dependency surface partly reduce its practical impact.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts or script injection, but all 14 action references are unpinned, one workflow grants top-level write access, and a high-confidence finding reports package installation outside a lockfile. These are workflow hygiene risks, not evidence of compromise.