ekapusta/oauth2-esia

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, which is a maintenance caution, but the recent release history and August repository push provide compensating evidence.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a modest process gap.

Security policycaution

The repository has no security policy, reducing transparency around vulnerability reporting, though this is not evidence of abandonment by itself.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkouts, or audit findings. However, all 5 action references are unpinned, which is a supply-chain hygiene weakness.