Polaris for PHP as an OAuth 2.1 and OpenID Connect provider: authorization code with PKCE, refresh rotation, client credentials, device flow, CIBA, token exchange, DPoP, dynamic registration and client ID metadata documents, discovery
62%
Total Score
caution
A three-day-old v0.11 release has only two commits from one contributor and no security policy, despite good documentation and tests.
The package declares 15 runtime dependencies, including several Polaris components and JWT libraries; this is a meaningful integration surface but not inherently unhealthy for an OAuth provider.
The package is only 3 days old with 4 releases and a median interval of about 1.1 days, so its maintenance record is too short to establish maturity.
One contributor made all 2 recent commits, creating a concentrated maintainer base. Organization ownership partly compensates by allowing maintenance handoff, but no second active contributor is shown.
Only 2 commits were recorded in the last 3 months, all during this very new release period. That is recent activity, but not yet a demonstrated maintenance cadence.
The repository has zero stars, forks, and watchers. Because the package is only 3 days old, this is weak supporting evidence rather than a major health concern.
We didn't find any vulnerabilities for this package.
| Dependency | Last Release | Score |
|---|---|---|
psr/clock Version ^1.0 | — | — |
symfony/uid Version ^7.0 || ^8.0 | — | — |
lcobucci/jwt Version ^5.6 | — | — |
polaris/core Version ^0.11 | — | — |
polaris/admin Version ^0.11 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.