ez-php/webauthn-metadata

Release historycaution

The package is less than a day old with five releases and no established long-term release history, so maintenance and stability remain unproven.

Repo bus factorcaution

All recent commits come from one contributor. The organization-owned repository provides some handoff capacity, so this is a caution rather than a severe risk.

Repo commit activitycaution

Only one commit was observed in the last three months from one active maintainer; this is consistent with a new project but does not yet demonstrate sustained maintenance.

Security policycaution

No repository security policy was found, leaving vulnerability-reporting guidance unclear for a security-sensitive WebAuthn metadata package.

Workflow auditcaution

The workflow audit completed cleanly with no untrusted checkouts, script injection, or high-severity findings, and job-level permissions are used. However, all 8 action references are unpinned, weakening build reproducibility and provenance.