satur.io/duckdb

Security policycaution

The repository has no published security policy. This is a transparency gap for reporting and handling vulnerabilities, although the available tooling provides some compensation.

Version stabilitycaution

The assessed version is a stable major release and is not a prerelease, but 70% of recent releases were prereleases. That makes the release history somewhat less predictable.

Workflow auditcaution

All 18 analyzed action references are unpinned, and a high-confidence medium-severity finding reports inherited secrets in a reusable workflow. The audit was complete and found no untrusted checkout or script-injection paths, but the workflow hygiene still warrants caution.