svix

Lifecycle scriptscaution

A prepare install-time script is present. This is a supply-chain surface that merits awareness, but the provided signal does not show unsafe behavior or unusual script names.

Workflow auditcaution

The audit covered 30 of 37 workflows and found no high-severity issues, untrusted checkouts, or script injection, but 52 of 98 action references are unpinned and high-confidence secrets-inherit findings expose credentials more broadly than necessary. Five workflows use top-level write permissions, and the audit is incomplete because seven workflows were not analyzed; the low-confidence-independent adhoc package installation is only a minor hygiene issue.