baha2odeh/yii2-oauth

Project backingcaution

The repository is owned by an individual user rather than an organization, so the single-maintainer and concentrated-contribution concerns are not offset by visible organizational backing.

Release historycaution

The package is about four months old with six releases, all within the last 12 months; releases arrived rapidly, roughly one every 1.2 hours at the median, so long-term maintenance is not yet established.

Repo bus factorcaution

One contributor made all recent commits, with a 100% commit share. The user-owned project backing provides no demonstrated organizational handoff capacity, leaving a high bus-factor risk.

Repo commit activitycaution

Only two commits were recorded in the last three months, from one active maintainer. That is limited recent maintenance evidence for an OAuth server extension.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. For an OAuth server extension, that missing layer is a meaningful hygiene gap.