mfc/oauth2

Licensecaution

A license file is present, but it identifies GPL-3.0 while the manifest declares GPL-2.0-or-later; that mismatch should be resolved before relying on the release.

Repo bus factorcaution

All three recent commits came from one contributor. Organization backing provides some handoff capacity, but current activity is still concentrated.

Repo commit activitycaution

Only three commits were made in the last three months, so recent maintenance is present but light.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected, leaving a modest assurance gap.

Workflow auditcaution

Both workflows were analyzed without dangerous triggers or untrusted checkouts, but all 11 action references are unpinned. High-confidence template-injection findings in the publish workflow are a workflow hygiene concern; the low-confidence cache-poisoning finding carries little additional weight.