fouladgar/laravel-otp

Project backingcaution

The repository is owned by an individual rather than an organization, so the active contributors provide the main continuity evidence and the concentrated commit share remains relevant.

Repo bus factorcaution

The top contributor made about 71% of recent commits, creating some concentration risk, although two additional contributors were active during the same period.

Repo toolingcaution

Composer build tooling is present, but no security scanning tooling was detected; this is a modest transparency and maintenance gap rather than a release-blocking issue.

Security policycaution

The repository has no published security policy, leaving vulnerability reporting and response expectations less clear.

Workflow auditcaution

All four action references are unpinned, and the audit found a high-confidence unpinned container image; workflows otherwise have no untrusted checkout or script-injection findings and no broad top-level write permissions.