otplib

Project backingcaution

The repository is owned by an individual rather than an organization, so the concentrated contributor activity is not offset by visible organizational handoff capacity.

Repo bus factorcaution

Two contributors were active in the last 3 months, but one made 16 of 17 commits, leaving maintenance highly concentrated and creating a moderate continuity risk.

Workflow auditcaution

All seven workflows were analyzed, use read-only permissions, and have no unpinned action references or untrusted checkouts. Two high-confidence template-injection findings in mutation and release workflows remain a workflow-hygiene concern, but no dangerous trigger or sink was reported.