webfox/laravel-xero-oauth2

Repo bus factorcaution

All recent commits came from one contributor, creating a narrow active-maintainer base. Organization backing provides some capacity for handoff, but no second active contributor is shown.

Repo commit activitycaution

Only 1 commit was recorded in the last 3 months, showing limited recent development activity despite the recent release.

Security policycaution

The repository has no published security policy, reducing transparency for reporting and handling vulnerabilities.

Workflow auditcaution

Both workflows were fully analyzed with no dangerous triggers or audit findings, but all 7 action references are unpinned. The absence of a top-level permissions block is acceptable on its own and no write-wide token permissions were found.