async-aws/cognito-identity-provider

Repo bus factorcaution

One contributor made all commits in the last three months, producing a concentrated recent bus factor. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, so recent activity is present but thin. This is a mild maintenance concern rather than evidence of abandonment because the release history remains steady.

Repo toolingcaution

The repository uses Make and Composer, but no security-scanning tools were detected. That is a transparency and review gap, though it is not evidence of unsafe code by itself.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and disclosure expectations undocumented. The package's active organization backing partly offsets this gap but does not remove it.

Workflow auditcaution

Both workflows were analyzed cleanly with no untrusted checkout, script injection, or audit findings, and neither uses broad top-level write permissions. However, all four referenced actions are unpinned, which weakens build reproducibility and earns a hygiene caution.