yaml-language-server

Security policycaution

No repository security policy was found, leaving vulnerability-reporting expectations less clear despite the presence of CodeQL scanning.

Workflow auditcaution

Both workflows were analyzed successfully with no untrusted checkout or script-injection findings. However, 10 of 17 action references are unpinned, and the release workflow installs packages outside the lockfile; the low-confidence cache findings are hygiene concerns rather than standalone severe risks.