unstorage

Build provenancecaution

No build attestation or trusted-publisher identity is present, reducing publication transparency. This is a supply-chain hygiene gap rather than evidence that the release is unsafe.

Repo issue activitycaution

The repository is receiving issues and pull requests, but only one issue was closed and no pull requests were merged in the last month, suggesting some backlog pressure.

Repo toolingcaution

The project uses TypeScript, Vite, and npm scripts for builds. No security scanning tools were detected, leaving a modest security-process gap.

Security policycaution

The repository has no security policy, so its process for receiving and coordinating vulnerability reports is not documented.

Workflow auditcaution

The audit analyzed both workflows completely and found no untrusted checkout, script injection, or unpinned action use. However, it identified a high-confidence unsound condition and repeated high-confidence ad hoc package installs, creating a real workflow-hygiene concern.