joshcirre/duo

Maintainerscaution

Only one account has registry publish access, which creates some publishing concentration. The repository's two active contributors provide partial operational support, but the registry maintainer base remains narrow.

Project backingcaution

The repository is owned by an individual account rather than an organization, so there is no organizational handoff capacity to offset the small maintainer base. Balanced recent contributions still provide some support.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing automated security check is a modest repository hygiene gap rather than evidence of unsafe code.

Security policycaution

The repository has no security policy. For a package that handles application data and offline synchronization, this reduces transparency about vulnerability reporting and response expectations.

Version stabilitycaution

Version v0.2.0 is not a stable major release, so compatibility and API changes remain more likely than for a mature 1.x package. It is not marked as a prerelease, which partly offsets that concern.