joomla/oauth2

Repo bus factorcaution

All recent commit activity came from one contributor, leaving the project dependent on a single active maintainer despite organization backing.

Repo commit activitycaution

There was one commit in the last three months, so maintenance is present but relatively light.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected, leaving a meaningful security-process gap.

Version stabilitycaution

The assessed release is a stable major and not a prerelease, but the reported latest version is 3.0.3 while this assessment targets 4.0.2, creating a minor metadata consistency concern.

Workflow auditcaution

The only workflow was fully analyzed with no high-confidence audit findings or untrusted checkout and injection patterns. However, its one action is unpinned, which weakens reproducibility, and it lacks a top-level permissions block; the latter is acceptable on its own.