cultuurnet/jwt-provider

Dependency profilecaution

The application declares 22 runtime dependencies, creating a relatively broad dependency surface for a small project. The signal provides no evidence that this is unmanaged, so this is a modest transparency and maintenance concern rather than a severe risk.

Repo commit activitycaution

The repository recorded zero commits and zero active maintainers in the last three months, despite a recent package release. That weakens evidence of ongoing source maintenance and increases abandonment uncertainty.

Repo toolingcaution

The project uses Make and Composer, but no security-scanning tool was detected. Build tooling is present, while automated security coverage is not evident.

Security policycaution

The repository has no security policy. For an authentication-focused application, this leaves vulnerability reporting and handling less transparent.

Workflow auditcaution

The single workflow was fully analyzed with no detected dangerous sinks or audit findings, but all 9 action references are unpinned. That leaves the build exposed to action changes and is a workflow hygiene concern.