itk-dev/os2forms_nemlogin_openid_connect

Repo bus factorcaution

All three recent commits came from one contributor. Organization ownership provides some handoff capacity, but no second active contributor is shown in this period.

Repo commit activitycaution

The repository received three commits in the last three months, showing recent activity, but the volume is modest for a security-sensitive authentication component.

Repo toolingcaution

Composer build tooling is present, but no security-scanning tooling was detected. That reduces automated visibility into dependency and code risks.

Security policycaution

The repository has no security policy. For an authentication module, the absence of documented vulnerability-reporting procedures is a meaningful transparency gap.

Workflow auditcaution

The sole workflow analyzed successfully and has no untrusted checkout or injection-trigger combination, but all 16 action references are unpinned and the audit found a high-confidence template-injection pattern. These are workflow hygiene concerns rather than standalone evidence that the release is unfit.