@reown/appkit-pay

Dangerous workflowscaution

One of 15 workflows uses pull_request_target, which warrants some workflow review, but there are no detected untrusted checkouts or script-injection patterns.

Package scaffoldingcaution

The artifact includes tests, while the repository has tests, a changelog, GitHub releases, and release notes for this exact version. The missing package README is a consumer-facing documentation gap, but the release notes provide useful change documentation.

Repo package mentioncaution

The repository name differs from the package name, which is normal for a monorepo, but its README does not mention this package; that weakens direct package transparency slightly.

Security policycaution

The repository has no SECURITY.md or equivalent security policy, leaving vulnerability reporting and response guidance undocumented.

Token permissionscaution

Seven workflows lack top-level permissions and four declare top-level write permissions, creating avoidable workflow-hardening concerns despite other workflows using read-only or job-level permissions.