citation-style-language/locales

Security policycaution

The repository has no published security policy. This is a transparency gap, though the package is primarily a collection of locale data rather than executable code.

Workflow auditcaution

All 19 analyzed action references are unpinned, and one workflow checks out untrusted content under pull_request_target, creating workflow-hygiene risk. The cache-poisoning finding is low confidence and is treated as hygiene rather than a severe standalone risk; all workflows otherwise use read-only permissions.