oat-sa/extension-tao-xmledit

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and disclosure expectations unclear.

Workflow auditcaution

All four workflows were analyzed with no untrusted checkouts or script injection, but the audit found a high-confidence medium-severity secrets-inherit issue and all seven action references are unpinned. The absence of top-level permissions is not a concern by itself, and organization backing partly offsets the workflow hygiene risk.