tslog

Build provenancecaution

The release has no attestation, trusted publisher identity, or staged-publishing record, leaving publication origin less transparent than it could be.

Repo bus factorcaution

One contributor made 102 of 105 recent commits, or about 97%, creating a meaningful continuity risk despite the organization-owned repository and two additional active contributors.

Repo toolingcaution

The repository uses established build and test tooling, but no security scanning tools were detected, leaving a security-process gap.

Security policycaution

The repository has no security policy, so vulnerability reporting and response expectations are not documented.

Token permissionscaution

One workflow lacks top-level permissions and another declares top-level write access; this is weaker least-privilege hygiene, although no dangerous workflow pattern was detected.