zimmerframe

Repo toolingcaution

The project uses TypeScript and Vitest for build and test tooling. No security scanning tool was detected, a minor transparency gap rather than a standalone adoption blocker.

Workflow auditcaution

Both workflows were fully audited with no dangerous triggers, untrusted checkouts, script injection, or audit findings. However, all 10 action references are unpinned, leaving avoidable action-integrity risk.