tradecoverexchange/google-cloud-jwt-validator

Release historycaution

The latest release was about 5 years and 8 months ago, with no releases in the last 12 months. This is a substantial maintenance concern for a package handling authentication, despite its three-release history showing it was once developed.

Repo commit activitycaution

There were no commits and no active maintainers in the last 3 months, consistent with repository activity having stopped in January 2023. This materially increases abandonment risk.

Repo toolingcaution

Composer build tooling is present, but no security scanning tools were detected. For a JWT validation package, that is a meaningful transparency and maintenance gap.

Security policycaution

The repository has no security policy. That makes vulnerability reporting and coordinated maintenance less clear for a security-sensitive library.

Workflow auditcaution

All 11 action references are unpinned, and the audit found high-confidence bot-condition and unpinned-image issues. The pull_request_target workflow has no untrusted checkout or script-injection sink, so these are hygiene risks rather than a severe workflow threat.