surfoo/oauth2-geocaching
Documentation, tests, and release notes make integration and changes clear. The small project has little redundancy, and its workflow references are not pinned, so maintenance and build reproducibility depend heavily on the owner and upstream actions.
78%
Total Score
67
94
67
Health Score Breakdown
The repository is owned by an individual rather than an organization, so the single-contributor concentration is not offset by visible organizational backing.
All five recent commits came from one contributor, leaving no demonstrated contributor redundancy if that maintainer becomes unavailable.
Composer build tooling is present, but no security-scanning tooling was observed, leaving a modest assurance gap.
The repository has no security policy, making vulnerability reporting and coordinated disclosure less transparent.
The single workflow was fully analyzed with no audit findings or untrusted execution sinks, but all 10 action references are unpinned, weakening build reproducibility and update integrity.
Vulnerabilities
We didn't find any vulnerabilities for this package.
Package versions
Maintainers
 Surfoo |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version ^3.0 | — | — |
php-http/promise Version ^1.1 | — | — |
league/oauth2-client Version ^2.9 | — | — |
php-http/client-common Version ^2.7 | — | — |
Weekly Downloads
Info
- Last Published
- 2 months ago
- Created
- 8 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.