git:20260808.a95ae7c to git:20260814.51573e9

12 added, 0 removed. Audit A to A.

# @allxsmith/bestax-bulma

React components for Bulma v1.

- Docs index: https://bestax.io/llms.txt

- Full docs (one file): https://bestax.io/llms-full.txt

- Any docs page as markdown: append .md (e.g. https://bestax.io/docs/api/elements/button.md)

- LLM guide: https://bestax.io/docs/guides/llms

- Agent skills: https://bestax.io/docs/skills/intro

- MCP server: `npx bestax-mcp` — setup at https://bestax.io/docs/guides/llms#mcp-server

+ Supply-chain posture — same claims as the package README; every item is verifiable:

+ - Signed provenance on every release (sigstore; check `npm audit signatures` or the npm Provenance section)

+ - npm OIDC trusted publishing — no long-lived `NPM_TOKEN`; release commits and tags are GPG-signed

+ - Socket.dev scans every PR for malware, install scripts, obfuscated code, and privilege escalation

+ - Install scripts blocked unless allow-listed; versions younger than 3 days will not install

+ - Every GitHub Action pinned to a full commit SHA

+ - CodeQL, Dependency Review, Dependabot, and a high-severity `pnpm audit` gate

+ - Layered AI review (CodeRabbit + an independent adversarial Claude review) plus required green CI, an approving review, and a human merge

+ Full detail: https://github.com/allxsmith/bestax/blob/main/SECURITY.md · https://bestax.io/docs/guides/security