unpdf

Repo toolingcaution

The project uses TypeScript, Vitest, Rolldown, and npm scripts for its build and tests. No security scanning tooling was detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, reducing transparency about vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were analyzed without untrusted triggers or script injection, and the high-severity cache-poisoning finding has low confidence. However, all 6 action references are unpinned, the release workflow has top-level write permissions, and a high-confidence audit found ad hoc package installation.