migears/security-token-auth

Project backingcaution

The repository is owned by a user account rather than an organization, so the project has a comparatively narrow visible ownership base. This is a modest capacity concern, not evidence of abandonment on its own.

Release historycaution

This is the package's first release, published 0 days ago, so there is no release track record or established maintenance cadence yet.

Repo toolingcaution

Composer build tooling is present, but no security scanning tool was detected. The missing scanner is a meaningful hygiene gap for an authentication package, though it is not evidence of unsafe code by itself.

Security policycaution

No security policy was found in the repository, leaving vulnerability-reporting expectations and response procedures undocumented for a security-focused package.

Workflow auditcaution

The single workflow was fully analyzed with no dangerous triggers, untrusted checkout, script injection, or auditor findings. However, all 3 of 3 action references are unpinned, which weakens build reproducibility and supply-chain integrity.