@octokit/auth-app

Repo bus factorcaution

All two recent commits came from one contributor, creating concentration risk; organization ownership provides some capacity to hand maintenance off if needed.

Repo commit activitycaution

Only two commits were made in the last three months by one active maintainer, which is thin recent activity, but it is partly offset by the recent repository push and established release cadence.

Workflow auditcaution

All six workflows were analyzed successfully with no reported findings or untrusted checkout or script-injection sinks. However, all 15 action references are unpinned, and two workflows grant top-level write permissions, creating a moderate workflow-hygiene concern without a demonstrated exploit path.