@octokit/auth-oauth-device

Repo bus factorcaution

All 3 recent commits came from one contributor, giving that person 100% of the recent commit share. Organizational ownership helps provide continuity, but no second recent contributor is shown, so this remains a maintenance-resilience concern.

Security policycaution

The repository has no published security policy. That is a transparency and vulnerability-reporting gap, though it is moderated by the presence of CodeQL scanning in the project tooling.

Workflow auditcaution

All 6 workflows were analyzed successfully and no audit findings or untrusted checkouts were reported; the pull_request_target triggers are therefore not dangerous on their own. However, all 14 action references are unpinned and two workflows grant top-level write permissions, creating a workflow hygiene concern without a demonstrated untrusted sink.