Evidence, scores, and the verdict above are computed by nittim. The written read below — this summary and every finding’s narrative — is Claude’s.The evidence, scores, and the verdict above are computed by nittim. The written explanation below — this summary and every finding’s write-up — is Claude’s, the AI assistant that reviewed your code.nittim computes the evidence, scores, and verdict. Claude writes the summary below.

This is `colinhacks/zod`, the widely-used TypeScript-first schema-validation library — a large, mature, exhaustively-tested monorepo (v3 legacy, v4 classic/mini/core, docs site, benchmarks, integration/treeshake harnesses). It is an OSS library, not a data-handling application, so most enterprise security/privacy/reliability dimensions apply only narrowly (to the CI/publish pipeline and the docs website). Code quality and architecture are excellent: careful prototype-pollution handling, ReDoS-aware regex work with recheck, memory/bundle-size regression guards, and broad automated tests. The material risks are concentrated in the supply-chain/CI surface: a `workflow_dispatch` agent workflow (pullfrog.yml) that grants an unpinned third-party action broad write permissions and every AI-provider secret, GitHub Actions pinned by mutable tag rather than commit SHA, and a docs website that ships Google/Vercel/Inkeep tracking with no consent gate. The scanner's dependency hits are almost entirely dev-only or scoped to the docs `next` app; the published `zod` package has zero runtime dependencies, so those advisories do not reach library consumers. The two committed JWTs are test fixtures, not live credentials. No audit-tampering content was found. The codebase is clearly long-lived human authorship.