empuxa/laravel-totp-login

Maintainerscaution

Only one registry publishing account is listed, which creates operational concentration. The organization-owned repository provides some backing, but does not remove the single-publisher concern.

Repo bus factorcaution

All recent commits came from one contributor. Organization ownership offers some handoff capacity, so this is a caution rather than a severe abandonment signal.

Repo commit activitycaution

The repository has one commit in the last three months from one active maintainer. Recent releases and merged pull requests compensate for some of the low commit volume, but ongoing maintenance capacity remains narrow.

Repo popularitycaution

Two stars and no forks indicate limited external adoption, which weakens community validation but is supporting evidence rather than a health verdict.

Workflow auditcaution

All five workflows were analyzed, but every action reference is unpinned, three workflows grant top-level write permissions, and a high-confidence bot-conditions finding affects the Dependabot auto-merge workflow. The pull_request_target trigger has no untrusted checkout or script-injection sink, so the CI concerns are material hygiene risks rather than a standalone critical failure.