swagger-ui-dist

Maintainerscaution

Two publishers use the swagger.io domain, but ponelat and kyleshockey publish from Gmail addresses. With a clear company-backed project this is account-hygiene caution, not evidence of weak maintenance capacity.

Workflow auditcaution

All 10 workflows were analyzed with no untrusted checkout or script-injection findings, and several scope permissions at job level. However, one high-confidence bot-conditions finding and 27 unpinned action references warrant caution; the cache-poisoning and GITHUB_ENV findings are low confidence and mainly hygiene concerns.