Cysharp/UniTask
Provides an efficient allocation free async/await integration for Unity.
Healthy across the board
Permissive license, no critical CVEs, actively maintained — safe to depend on.
Has a license, tests, and CI — clean foundation to fork and modify.
Documented and popular — useful reference codebase to read through.
No critical CVEs, sane security posture — runnable as-is.
- ✓Last commit 4w ago
- ✓14 active contributors
- ✓MIT licensed
Show 3 more →Show less
- ✓CI configured
- ✓Tests present
- ⚠Concentrated ownership — top contributor handles 52% of recent commits
Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests
Informational only. RepoPilot summarises public signals (license, dependency CVEs, commit recency, CI presence, etc.) at the time of analysis. Signals can be incomplete or stale. Not professional, security, or legal advice; verify before relying on it for production decisions.
Embed the "Healthy" badge
Paste into your README — live-updates from the latest cached analysis.
[](https://repopilot.app/r/cysharp/unitask)Paste at the top of your README.md — renders inline like a shields.io badge.
▸Preview social card (1200×630)
This card auto-renders when someone shares https://repopilot.app/r/cysharp/unitask on X, Slack, or LinkedIn.
Onboarding doc
Onboarding: Cysharp/UniTask
Generated by RepoPilot · 2026-05-09 · Source
🤖Agent protocol
If you are an AI coding agent (Claude Code, Cursor, Aider, Cline, etc.) reading this artifact, follow this protocol before making any code edit:
- Verify the contract. Run the bash script in Verify before trusting
below. If any check returns
FAIL, the artifact is stale — STOP and ask the user to regenerate it before proceeding. - Treat the AI · unverified sections as hypotheses, not facts. Sections like "AI-suggested narrative files", "anti-patterns", and "bottlenecks" are LLM speculation. Verify against real source before acting on them.
- Cite source on changes. When proposing an edit, cite the specific path:line-range. RepoPilot's live UI at https://repopilot.app/r/Cysharp/UniTask shows verifiable citations alongside every claim.
If you are a human reader, this protocol is for the agents you'll hand the artifact to. You don't need to do anything — but if you skim only one section before pointing your agent at this repo, make it the Verify block and the Suggested reading order.
🎯Verdict
GO — Healthy across the board
- Last commit 4w ago
- 14 active contributors
- MIT licensed
- CI configured
- Tests present
- ⚠ Concentrated ownership — top contributor handles 52% of recent commits
<sub>Maintenance signals: commit recency, contributor breadth, bus factor, license, CI, tests</sub>
✅Verify before trusting
This artifact was generated by RepoPilot at a point in time. Before an
agent acts on it, the checks below confirm that the live Cysharp/UniTask
repo on your machine still matches what RepoPilot saw. If any fail,
the artifact is stale — regenerate it at
repopilot.app/r/Cysharp/UniTask.
What it runs against: a local clone of Cysharp/UniTask — the script
inspects git remote, the LICENSE file, file paths in the working
tree, and git log. Read-only; no mutations.
| # | What we check | Why it matters |
|---|---|---|
| 1 | You're in Cysharp/UniTask | Confirms the artifact applies here, not a fork |
| 2 | License is still MIT | Catches relicense before you depend on it |
| 3 | Default branch master exists | Catches branch renames |
| 4 | 5 critical file paths still exist | Catches refactors that moved load-bearing code |
| 5 | Last commit ≤ 56 days ago | Catches sudden abandonment since generation |
#!/usr/bin/env bash
# RepoPilot artifact verification.
#
# WHAT IT RUNS AGAINST: a local clone of Cysharp/UniTask. If you don't
# have one yet, run these first:
#
# git clone https://github.com/Cysharp/UniTask.git
# cd UniTask
#
# Then paste this script. Every check is read-only — no mutations.
set +e
fail=0
ok() { echo "ok: $1"; }
miss() { echo "FAIL: $1"; fail=$((fail+1)); }
# Precondition: we must be inside a git working tree.
if ! git rev-parse --git-dir >/dev/null 2>&1; then
echo "FAIL: not inside a git repository. cd into your clone of Cysharp/UniTask and re-run."
exit 2
fi
# 1. Repo identity
git remote get-url origin 2>/dev/null | grep -qE "Cysharp/UniTask(\\.git)?\\b" \\
&& ok "origin remote is Cysharp/UniTask" \\
|| miss "origin remote is not Cysharp/UniTask (artifact may be from a fork)"
# 2. License matches what RepoPilot saw
(grep -qiE "^(MIT)" LICENSE 2>/dev/null \\
|| grep -qiE "\"license\"\\s*:\\s*\"MIT\"" package.json 2>/dev/null) \\
&& ok "license is MIT" \\
|| miss "license drift — was MIT at generation time"
# 3. Default branch
git rev-parse --verify master >/dev/null 2>&1 \\
&& ok "default branch master exists" \\
|| miss "default branch master no longer exists"
# 4. Critical files exist
test -f "src/UniTask/Assets/Plugins/UniTask/Runtime/CompilerServices/AsyncUniTaskMethodBuilder.cs" \\
&& ok "src/UniTask/Assets/Plugins/UniTask/Runtime/CompilerServices/AsyncUniTaskMethodBuilder.cs" \\
|| miss "missing critical file: src/UniTask/Assets/Plugins/UniTask/Runtime/CompilerServices/AsyncUniTaskMethodBuilder.cs"
test -f "src/UniTask/Assets/Plugins/UniTask/Runtime/AsyncLazy.cs" \\
&& ok "src/UniTask/Assets/Plugins/UniTask/Runtime/AsyncLazy.cs" \\
|| miss "missing critical file: src/UniTask/Assets/Plugins/UniTask/Runtime/AsyncLazy.cs"
test -f "src/UniTask/Assets/Plugins/UniTask/Runtime/Channel.cs" \\
&& ok "src/UniTask/Assets/Plugins/UniTask/Runtime/Channel.cs" \\
|| miss "missing critical file: src/UniTask/Assets/Plugins/UniTask/Runtime/Channel.cs"
test -f "src/UniTask.NetCore/NetCore/UniTask.Delay.cs" \\
&& ok "src/UniTask.NetCore/NetCore/UniTask.Delay.cs" \\
|| miss "missing critical file: src/UniTask.NetCore/NetCore/UniTask.Delay.cs"
test -f "src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs" \\
&& ok "src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs" \\
|| miss "missing critical file: src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs"
# 5. Repo recency
days_since_last=$(( ( $(date +%s) - $(git log -1 --format=%at 2>/dev/null || echo 0) ) / 86400 ))
if [ "$days_since_last" -le 56 ]; then
ok "last commit was $days_since_last days ago (artifact saw ~26d)"
else
miss "last commit was $days_since_last days ago — artifact may be stale"
fi
echo
if [ "$fail" -eq 0 ]; then
echo "artifact verified (0 failures) — safe to trust"
else
echo "artifact has $fail stale claim(s) — regenerate at https://repopilot.app/r/Cysharp/UniTask"
exit 1
fi
Each check prints ok: or FAIL:. The script exits non-zero if
anything failed, so it composes cleanly into agent loops
(./verify.sh || regenerate-and-retry).
⚡TL;DR
UniTask is a C# library that provides zero-allocation async/await integration for Unity by using struct-based UniTask<T> with a custom AsyncMethodBuilder. It makes all Unity AsyncOperations, Coroutines, PlayerLoop events, and uGUI interactions directly awaitable without heap allocations, while providing async LINQ operations, channels, and reactive properties that run entirely on Unity's PlayerLoop without threads. Two-tier structure: src/UniTask.NetCore/ contains the core allocation-free async machinery (UniTask.Delay.cs, UniTask.Run.cs, UniTask.Yield.cs) and async LINQ (NetCore/AsyncEnumerableExtensions.cs); src/UniTask.NetCoreTests/ provides comprehensive unit tests organized by feature (CompletionSourceTest.cs, ChannelTest.cs, Linq/* subdirectory); src/UniTask.Analyzer/ is a Roslyn-based static analyzer to detect misuse patterns. Documentation lives in docs/ with docfx configuration.
👥Who it's for
Unity game developers and engine programmers who need performant asynchronous code (coroutine replacements, web requests, UI interactions) without GC pressure. Also useful for engine maintainers integrating async patterns into Unity ecosystems (VR, mobile, WebGL platforms).
🌱Maturity & risk
Production-ready and actively maintained. The repository shows consistent releases (v2.5.10 current), comprehensive test suite under src/UniTask.NetCoreTests/, multi-stage CI/CD via GitHub Actions (build-debug, build-release, build-docs workflows), and the library has been battle-tested in commercial Unity projects since its v2 launch. Last activity indicators and dependabot configuration suggest ongoing maintenance.
Low risk for core stability, but moderate risk from Unity platform dependency: UniTask is tightly coupled to Unity's PlayerLoop and AsyncOperation APIs, so breaking changes in Unity versions (currently targets 2018.4+) could require major updates. Single-maintainer risk exists (Cysharp, Inc. organization), though the MIT license and open-source nature mitigate lock-in. No external NuGet dependencies listed in package.json minimizes supply-chain risk.
Active areas of work
Active maintenance on pooling, compatibility layers, and analyzer tooling. GitHub Actions workflows indicate ongoing CI builds for debug and release configurations. The dependabot.yaml suggests automated dependency updates are enabled. No specific breaking-change work visible in file list, indicating stability focus.
🚀Get running
Clone the repository: git clone https://github.com/Cysharp/UniTask.git && cd UniTask. For .NET Core testing/development: dotnet sln build UniTask.NetCore.sln or open in Visual Studio. For Unity integration: add via UPM git URL to your Unity project's Packages/manifest.json pointing to https://github.com/Cysharp/UniTask.git?path=src/UniTask.NetCore.
Daily commands:
For .NET Core testing: dotnet test src/UniTask.NetCoreTests/UniTask.NetCoreTests.csproj. For sandbox/demo: dotnet run --project src/UniTask.NetCoreSandbox/. For Unity: import the package and use UniTask and UniTask<T> as drop-in replacements for Task in async methods.
🗺️Map of the codebase
src/UniTask/Assets/Plugins/UniTask/Runtime/CompilerServices/AsyncUniTaskMethodBuilder.cs— Core async method builder that enables zero-allocation async/await by implementing custom compiler services for UniTask struct types.src/UniTask/Assets/Plugins/UniTask/Runtime/AsyncLazy.cs— Implements lazy async initialization pattern, essential for understanding UniTask's memory efficiency and state management.src/UniTask/Assets/Plugins/UniTask/Runtime/Channel.cs— Provides async-safe channel communication primitive used throughout UniTask's async composition patterns.src/UniTask.NetCore/NetCore/UniTask.Delay.cs— Demonstrates how UniTask integrates with PlayerLoop for frame-based delays without threads, central to Unity integration.src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs— Implements async LINQ operators that compose UniTask operations, showing the API surface for common async patterns.src/UniTask/Assets/Plugins/UniTask/Runtime/AsyncReactiveProperty.cs— Reactive property implementation showing how UniTask bridges async operations with observable state changes.src/UniTask.Analyzer/UniTaskAnalyzer.cs— Roslyn analyzer that detects improper UniTask usage patterns, critical for preventing memory leaks in user code.
🛠️How to make changes
Add a new LINQ operator for async sequences
- Create a new extension method in AsyncEnumerableExtensions.cs that accepts IAsyncEnumerable<T> and returns IAsyncEnumerable<U> (
src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs) - Implement the operator using a local async generator function or custom IAsyncEnumerator to handle subscription and iteration (
src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs) - Add unit test cases in corresponding Linq test file (e.g., Linq/Projection.cs or Linq/Filtering.cs) following existing test patterns (
src/UniTask.NetCoreTests/Linq/Projection.cs)
Add a new PlayerLoop-based async operation (e.g., frame counter)
- Create new method in UniTask.NetCore/NetCore/ directory (e.g., UniTask.FrameCount.cs) following UniTask.Delay.cs pattern (
src/UniTask.NetCore/NetCore/UniTask.Delay.cs) - Use PlayerLoopHelper or similar mechanism to register callback with appropriate PlayerLoopTiming phase (
src/UniTask.NetCore/NetCore/UniTask.Yield.cs) - Return UniTask or UniTask<T> struct with custom awaiter that hooks into the PlayerLoop callback (
src/UniTask.NetCore/NetCore/UniTask.Delay.cs)
Implement a new async-reactive data structure
- Create new file in Runtime/ (e.g., AsyncReactiveCollection.cs) modeling AsyncReactiveProperty.cs and AsyncLazy.cs (
src/UniTask/Assets/Plugins/UniTask/Runtime/AsyncReactiveProperty.cs) - Implement IAsyncEnumerable or IAsyncEnumerator to support async composition with LINQ operators (
src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs) - Add comprehensive tests in NetCoreTests/ covering state changes, cancellation, and async iteration (
src/UniTask.NetCoreTests/AsyncReactivePropertyTest.cs)
Add a new static analysis rule to the Roslyn analyzer
- Extend UniTaskAnalyzer.cs to detect new anti-patterns (e.g., fire-and-forget without proper handling) (
src/UniTask.Analyzer/UniTaskAnalyzer.cs) - Register the diagnostic descriptor with appropriate severity and provide actionable error messages (
src/UniTask.Analyzer/UniTaskAnalyzer.cs) - Test the analyzer in the sandbox project (UniTask.NetCoreSandbox/Program.cs) to verify detection behavior (
src/UniTask.NetCoreSandbox/Program.cs)
🔧Why these technologies
- Struct-based UniTask<T> with custom AsyncMethodBuilder — Enables stack-allocated awaitable types, eliminating heap allocation per async operation while maintaining C# async/await syntax.
- PlayerLoop integration instead of threading — Allows frame-synchronized async operations in Unity without thread overhead, compatible with WebGL/WASM and single-threaded builds.
- Roslyn Analyzer (static code analysis) — Detects memory leak patterns and improper UniTask usage at compile time, preventing runtime issues in user code.
- IAsyncEnumerable<T> and LINQ operators — Provides familiar functional composition patterns for async sequences, reducing boilerplate and improving code readability.
- CancellationToken integration — Standard .NET cancellation pattern ensures compatibility with existing tooling and allows graceful operation shutdown.
⚖️Trade-offs already made
-
Struct-based UniTask vs reference type Task
- Why: Zero-allocation requirement contradicts reference types; stack structs avoid heap but require explicit boxing avoidance.
- Consequence: Developers must be careful not to box UniTask in collections; trade-off is worth it for high-throughput scenarios (thousands of concurrent ops).
-
PlayerLoop-only execution instead of ThreadPool
- Why: Unity's single-threaded renderer requires synchronization; threading adds complexity and breaks WebGL/WASM platforms.
- Consequence: Cannot leverage CPU parallelism for compute-heavy async work; suitable for I/O and frame-synchronized logic only.
-
Custom async method builder instead of System.Threading.Tasks.Task
- Why: Standard Task allocates heap and relies on ThreadPool; UniTask provides zero-allocation alternative for Unity contexts.
- Consequence: Requires explicit compiler support and different binary compatibility; .NET Standard projects cannot reuse UniTask directly.
-
Analyzer as separate package (UniTask.Analyzer)
- Why: Static analysis is optional tooling; keeping it separate avoids adding dependencies to runtime package.
- Consequence: Users must explicitly install analyzer; without it, memory leak patterns may go undetected in their code.
🚫Non-goals (don't propose these)
- Does not provide multi-
🪤Traps & gotchas
- PlayerLoop integration is single-threaded by design—all UniTask code runs on Unity's main thread, so ThreadPool operations require explicit UniTask.Run() with async delegates; blocking on UniTask results will deadlock. 2. Struct-based UniTask<T> can be boxed by accident (e.g., passing to non-generic collections or implicit object conversion)—use the analyzer to catch this. 3. CancellationToken handling differs subtly from Task (UniTask respects PlayerLoop frames for delay cancellation), so direct Task<->UniTask conversions require careful testing. 4. WebGL and WASM builds have no thread support, so only PlayerLoop-based operations work; verify with conditional compilation (UNITY_WEBGL).
🏗️Architecture
💡Concepts to learn
- Custom AsyncMethodBuilder — UniTask's zero-allocation magic relies on implementing IAsyncMethodBuilder to replace the default CLR compiler-generated state machine with a pooled, struct-based version—core to understanding how UniTask avoids heap allocations that standard async/await incurs
- PlayerLoop Integration (Unity Event Loop) — UniTask hooks into Unity's PlayerLoop (FixedUpdate, Update, LateUpdate phases) to drive async completion without threads; essential for WebGL support and understanding why UniTask.Delay frames exist instead of Thread.Sleep
- IValueTaskSource Interface — UniTask<T> implements IValueTaskSource<T> to enable custom completion logic and pooling; understanding this contract is key to extending UniTask with custom awaitable types
- Async LINQ (IAsyncEnumerable) — UniTask provides allocation-free LINQ operators over IAsyncEnumerable<T> using custom iterators; used for chaining async operations (Select, Where, etc.) without intermediate collections or Task allocations
- Object Pooling for Async State — UniTask reuses async state machine instances via CompletionSource pooling; critical for understanding the 'zero allocation' claim and why disposing/resetting UniTask objects matters in hot loops
- Struct-based Value Types in Async Context — UniTask<T> is a struct (not a class like Task<T>), enabling stack allocation and better cache locality; understanding struct semantics, boxing pitfalls, and move semantics is critical to avoiding performance regressions
- Decorator Pattern for AsyncOperation Wrapping — UniTask wraps Unity's AsyncOperation, Coroutine, and uGUI events through adapter/decorator pattern (e.g., ToUniTask extensions); pattern for understanding how UniTask integrates with existing Unity APIs
🔗Related repos
microsoft/vsthreading— Provides JoinableTaskFactory and async patterns for Visual Studio; similar async-without-threads goals but for desktop/server ecosystems instead of game enginesdotnet/runtime— CoreCLR and libraries that define ValueTask and AsyncMethodBuilder patterns that UniTask's custom builder mimics and extends for zero-allocationCysharp/Utf8Json— Sister project by Cysharp focused on allocation-free JSON serialization; shares the same zero-allocation ethos and often used alongside UniTask in Unity projectsreactive-extensions/reactive-extensions— Rx.NET provides reactive streams and observables; UniTask's AsyncReactiveProperty and Channel implementations are inspired by Rx patterns adapted for Unity's PlayerLoopMonoGame/MonoGame— Cross-platform .NET game engine with similar async/await needs; UniTask patterns could inform MonoGame's task scheduler (no direct code sharing but conceptual competitor)
🪄PR ideas
To work on one of these in Claude Code or Cursor, paste:
Implement the "<title>" PR idea from CLAUDE.md, working through the checklist as the task list.
Add comprehensive analyzer tests for UniTask.Analyzer
The UniTask.Analyzer project (src/UniTask.Analyzer/UniTaskAnalyzer.cs) exists but has no corresponding test suite visible in the file structure. A new contributor could create src/UniTask.Analyzer.Tests to validate analyzer diagnostics and code fixes, ensuring the analyzer correctly catches common UniTask misuse patterns (e.g., not awaiting UniTasks, incorrect async/await patterns). This is critical for a library that provides custom async tooling.
- [ ] Create src/UniTask.Analyzer.Tests/ directory with .csproj following xUnit pattern
- [ ] Add test cases for common analyzer diagnostics (e.g., unawaited UniTask, fire-and-forget detection)
- [ ] Integrate tests into UniTask.NetCore.sln and GitHub workflows (build-debug.yaml, build-release.yaml)
- [ ] Reference UniTaskAnalyzer.cs and validate rule IDs match documented diagnostics
Add WebGL/WASM-specific integration tests
The README emphasizes that UniTask 'runs completely on Unity's PlayerLoop so doesn't use threads and runs on WebGL, wasm, etc.' but src/UniTask.NetCoreTests/ contains no dedicated WebGL/WASM platform validation tests. A contributor could add tests that verify PlayerLoop-based operations (Yield, Delay, DelayFrame) work correctly in constrained threading environments.
- [ ] Create src/UniTask.NetCoreTests/WebGLCompatibilityTest.cs
- [ ] Add tests verifying no Thread/ThreadPool usage in: src/UniTask.NetCore/NetCore/UniTask.Delay.cs, UniTask.Yield.cs, UniTask.Run.cs
- [ ] Add conditional compilation tests for single-threaded scenarios
- [ ] Document expected behavior and add GitHub Actions matrix test for .NET runtime variations
Expand AsyncEnumerableExtensions test coverage in Linq/
src/UniTask.NetCore/NetCore/AsyncEnumerableExtensions.cs is a core feature but src/UniTask.NetCoreTests/Linq/ tests focus on individual operators. A contributor could add integration tests for complex async enumerable composition patterns (e.g., chaining multiple operators, exception handling across chains, memory behavior under stress).
- [ ] Create src/UniTask.NetCoreTests/Linq/CompositionTest.cs for complex operator chains
- [ ] Add stress tests in src/UniTask.NetCoreTests/Linq/AllocationTest.cs validating zero-allocation guarantees
- [ ] Test AsyncEnumerableExtensions edge cases: disposal, cancellation propagation, backpressure
- [ ] Reference AsyncEnumerableExtensions.cs and validate allocation patterns match UniTask's design goals
🌿Good first issues
- Add missing async LINQ operator tests: src/UniTask.NetCoreTests/Linq/ lacks comprehensive coverage for edge cases like empty sequences, cancellation during enumeration, and exception propagation in Select/Where chains. Pick one operator family and add tests following the existing test structure.
- Expand UniTask.Analyzer to detect boxing of UniTask<T>: Currently UniTaskAnalyzer.cs does basic checks; add Roslyn rules to flag implicit boxing (e.g., passing UniTask<T> to object parameters, calling ToString() without awaiting first) and document in docs/.
- Improve cross-platform test coverage: src/UniTask.NetCoreTests/ focuses on .NET Core; add platform-specific test markers or conditional tests for WebGL/WASM constraints (no threads, limited PlayerLoop events) and document in README under 'Platform Limitations'.
⭐Top contributors
Click to expand
Top contributors
- @guitarrapc — 52 commits
- @neuecc — 23 commits
- @github-actions[bot] — 6 commits
- @dvsilch — 5 commits
- @hmkc — 2 commits
📝Recent commits
Click to expand
Recent commits
a9e27c0— chore: add groups for dependabot (guitarrapc)73a63b7— Merge pull request #680 from Cysharp/ci/nuget_release (guitarrapc)30bec5d— ci: add id-token: write for NuGet Trusted Publish (guitarrapc)ec9204d— Merge pull request #679 from Cysharp/feature/nuget (guitarrapc)9a6584f— chore: Specify IsPackable=false on Directory.Build.props, explicitly true for target packages. (guitarrapc)98538ef— Merge pull request #677 from Cysharp/feature/docs (guitarrapc)519590c— chore: exclude tests assemblies (guitarrapc)dce4366— ci: change docfx target from source code to Unity built assemblies (guitarrapc)88026ab— ci: replace docfx build from container to docfx command (guitarrapc)95998ff— ci: dependabot cooldown 65d2ae (guitarrapc)
🔒Security observations
The UniTask codebase demonstrates strong security practices overall. It is a well-maintained open-source library with no evident hardcoded secrets, SQL injection risks, XSS vulnerabilities, or dangerous dependency patterns. The package.json shows no dependencies, reducing supply chain risk. Minor concerns include: verification that the opensource.snk file is appropriately public, review of GitHub Actions workflow configurations for proper secret handling and permission minimization, and standard test code hygiene. The project's focus on allocation-free async operations in Unity suggests security-conscious development practices. No critical or high-severity vulnerabilities were identified.
- Low · Potential Key File in Repository —
opensource.snk. The file 'opensource.snk' appears to be a Strong Name Key file. While this is typically used for open-source projects and is intentionally public, it should be verified that this is not a private signing key that could be misused. Fix: Verify that opensource.snk is indeed intended to be public and contains no private key material. If it's a public key only, document this explicitly. Consider adding to documentation that this is a public key file. - Low · GitHub Workflow Configuration Review —
.github/workflows/. Multiple GitHub workflow files exist (.github/workflows/*.yaml). Workflows can be security-sensitive if they use secrets, have overly permissive permissions, or execute untrusted code. The files prevent-github-change.yaml and dependabot.yaml require review for proper secret handling. Fix: Review all GitHub workflow files to ensure: 1) Secrets are not logged or exposed in outputs, 2) GITHUB_TOKEN permissions are minimized, 3) Dependency updates are properly validated, 4) Only trusted actions are used (preferably pinned to specific versions/hashes). - Low · Test Infrastructure Review —
src/UniTask.NetCoreTests/, src/UniTask.NetCoreSandbox/. The codebase includes test files and a sandbox project. Tests may inadvertently expose security issues or unsafe patterns that should not be in production code. Fix: Ensure test code does not contain hardcoded credentials, insecure algorithms, or patterns that could be copied to production. Regularly review test files for security issues.
LLM-derived; treat as a starting point, not a security audit.
👉Where to read next
- Open issues — current backlog
- Recent PRs — what's actively shipping
- Source on GitHub
Generated by RepoPilot. Verdict based on maintenance signals — see the live page for receipts. Re-run on a new commit to refresh.