• This action is a single dependency-free dist/index.js — auditable in one read
• Inbox generation is fully local; the action makes no network requests
• Pin to a commit SHA: uses: zerodrop-dev/setup-zerodrop@<sha>
• Releases are tagged and published from this repository only

Report security issues to founder@zerodrop.dev. Please do not open public issues for vulnerabilities.