yard/config-expander

Security policycaution

The repository has no security policy. This is a modest transparency gap for reporting and handling vulnerabilities, though the package has Dependabot scanning and active maintenance.

Workflow auditcaution

All nine analyzed action references are unpinned, and eight workflows use secrets inheritance with high-confidence medium findings; one workflow also has top-level write permissions. These are workflow hygiene and credential-scope concerns, but no untrusted checkout or script-injection paths were found.