sumocoders/framework-core-bundle

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package. Although a name mismatch can occur in a monorepo, the absence of both signals makes the package-to-repository relationship less transparent.

Security policycaution

No SECURITY.md policy was found. This is a modest transparency gap, although active maintenance and dependency scanning provide some compensating evidence.

Workflow auditcaution

All 23 analyzed action references are unpinned, and the audit found eight high-confidence unpinned-image findings across all three workflows. The workflows have no untrusted checkout or script-injection findings, so this is a hygiene caution rather than a severe risk.