boundstate/eventful

Workflow auditdanger

The audit found a high-confidence, high-severity github-app issue where the app token inherits blanket installation permissions, alongside 10 unpinned actions out of 11. The workflows are fully analyzed and have no untrusted checkouts or script injection, which limits but does not remove the concern.

Security policycaution

The repository has no security policy, reducing disclosure transparency for a package that handles calendar data and authentication-related behavior. Active maintenance and recent release notes provide some compensating evidence, but not a documented reporting path.