hexlet/html-tags

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, making the package-to-source relationship difficult to verify and raising a provenance concern.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting expectations unclear; this is a transparency gap, though not evidence of abandonment.

Workflow auditcaution

All three workflows were analyzed with no reported findings or untrusted checkouts, but all four action references are unpinned and one workflow grants top-level write access. The pull_request_target trigger has no detected sink, so this remains a hygiene concern rather than a severe workflow risk.