horde/token

Repo bus factorcaution

One contributor made all three recent commits, giving the repository a 100% top-contributor share. Organization backing provides some handoff capacity, but the observed maintenance base remains concentrated.

Repo commit activitycaution

Three commits were made in the last 3 months, showing recent activity, but all activity comes from one active maintainer. The recent pace is adequate but thin.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanning is a modest repository hygiene gap, not evidence of abandonment.

Security policycaution

The repository has no security policy. For a token library, this reduces transparency around vulnerability reporting and response expectations.

Workflow auditcaution

Both workflows were analyzed successfully with no reported audit findings, no untrusted checkout or script-injection paths, and one workflow using job-level permissions. However, 6 of 7 action references are unpinned, leaving a reproducibility and action-integrity hygiene gap.