turbo-stream

Build provenancecaution

No build attestation or trusted-publisher provenance was detected, so consumers cannot verify how this release was produced.

Repo toolingcaution

The project uses TypeScript, esbuild, Turbo, and npm scripts, but no security scanning tools were detected, leaving a modest process gap.

Security policycaution

No repository security policy was found, reducing transparency around vulnerability reporting and response.

Workflow auditcaution

Both workflows were fully analyzed with no untrusted checkouts, script injection, or audit findings, but all nine action references are unpinned and one workflow has top-level write permissions.