gbcl/oauth-logto

Release historycaution

This package has had only one release, published nearly two years ago, with no releases in the last 12 months. That is meaningful evidence of limited ongoing maintenance for an extension dependency.

Repo commit activitycaution

There were no commits and no active maintainers in the last three months, consistent with a project that may be effectively frozen. This is the strongest maintenance concern in the assessment.

Repo toolingcaution

The repository uses Composer for builds, but no security scanning tools were detected. The missing scanning is a hygiene limitation, not evidence that the package is unsafe.

Security policycaution

The repository has no security policy, leaving vulnerability reporting and disclosure expectations unspecified. This is a transparency gap, but not a severe dependency risk on its own.

Workflow auditcaution

The workflow audit found no high-confidence dangerous findings and no untrusted checkout or script-injection paths. However, all three analyzed action references are unpinned, which weakens build reproducibility and supply-chain hygiene.