otp-com/sdk-php

Repo bus factorcaution

All seven commits in the last three months came from one contributor, leaving maintenance dependent on a single active developer. Organizational backing partly offsets this risk because the repository belongs to an organization.

Repo toolingcaution

The project uses Composer for builds, but no security-scanning tool was detected. This is a transparency and maintenance gap, though the repository still provides tests and a security policy.

Token permissionscaution

Both workflows declare top-level write permissions, which grants broader automation privileges than necessary and increases workflow-impact risk. This is partly mitigated by the absence of detected dangerous workflow patterns.