fgtclb/typo3-oauth2-server

Release historycaution

The package is 478 days old with four releases and only one release in the last 12 months. Recent repository activity partly offsets the relatively sparse registry cadence, but maintenance evidence is limited.

Repo bus factorcaution

One contributor made 100% of the seven recent commits. The organization owner provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

The repository had seven commits in the last three months, showing current activity, but all were made by one active maintainer.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. This is a modest transparency and preventive-hygiene gap, not evidence of a defect.

Workflow auditcaution

All five workflows were analyzed without untrusted checkouts or script injection, and one scopes permissions at job level. However, all seven action references are unpinned, and the publish workflow has two high-confidence template-injection findings, warranting workflow hygiene caution.