lcobucci/jwt

Package scaffoldingcaution

The published artifact lacks a README, which is a minor consumer-facing documentation gap for a library. This is partly compensated by repository documentation, repository tests, and release notes for this exact version.

Repo bus factorcaution

Recent work is concentrated in two contributors, with the top contributor making about 71% of commits. The second active contributor provides some continuity, but the individual-owner project still has a relatively thin recent contributor base.

Repo toolingcaution

The repository uses Composer and Make-based build tooling, but no security-scanning tool was detected. This is a transparency and defense-in-depth gap, not evidence of unsafe behavior by itself.

Token permissionscaution

None of the eight workflows declares top-level token permissions. Although no workflow has an explicit top-level write permission or a detected dangerous pattern, the lack of least-privilege declarations is a workflow hygiene concern.