Most packages are safe (with or without @inbounds) when used with regular arrays.
I do not want to get people to alarmed, but most packages are likely unsafe when the user uses OffsetArray.jl and passes such an array in, so I propose a badge people could put on their package to signal it safe. The implication, if not there, unsafe (or not known to be so).
Note, there are also badges for CI testing, that imply the code is tested while misleading. It’s not clear what is tested, just that those tests passed, leading to false-sense-of-security.
If all instances of @inbounds are taken out of (or disabled in some other way) a package (and its dependencies, when that applies) then the package is NOT know to be safe, but it’s highly likely it would surface generic-related bugs in the package.
Why I proposed (the issue was closed):
https://github.com/JuliaLang/julia/issues/45353