videojs/video.js

Security policycaution

The repository has no security policy, reducing transparency for reporting and handling vulnerabilities; the available evidence does not show a compensating security process.

Workflow auditcaution

All 12 analyzed action references are unpinned, and one workflow has top-level write permissions; the audit also found high-severity cache-poisoning patterns only at low confidence plus high-confidence ad hoc package installs, so this is workflow hygiene risk rather than a standalone severe dependency risk.