ericmann/totp

Release historycaution

The package has had no registry release in more than 7 years, despite six releases overall. This is a meaningful abandonment concern, though the repository was pushed in August 2024.

Repo commit activitycaution

There were no commits and no active maintainers in the measured 3-month period, indicating limited current development activity. The later repository push prevents this from being a severe abandonment signal.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. This is a modest transparency and maintenance gap for a security-sensitive authentication library.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations unclear for a library implementing one-time-password authentication.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers or audit findings, but all 5 action references are unpinned. The missing top-level permissions blocks are acceptable on their own, while unpinned actions remain a hygiene caution.