scheb/2fa

Dependency profilecaution

The release has 14 runtime dependencies, including core Symfony components and authentication libraries; this is a substantial integration surface but is coherent for a Symfony two-factor authentication bundle.

Project backingcaution

The package and repository are owned by the same individual account rather than an organization, so there is no organizational handoff capacity to offset the concentrated contributor base.

Repo bus factorcaution

All recent commit activity comes from one contributor, creating a meaningful continuity risk if that maintainer becomes unavailable.

Repo commit activitycaution

Only one commit was recorded in the last 3 months, showing recent activity but a slower maintenance pace than the strong release history suggests.

Workflow auditcaution

All 10 analyzed action references are unpinned, and a high-confidence finding reports a floating latest container image in split.yaml. The audit was complete and found no untrusted checkout or script-injection path, but the image pinning gap remains a supply-chain hygiene concern.