aporat/store-receipt-validator

Security policycaution

The repository has no published security policy. That is a transparency gap for a library handling purchase validation, although active maintenance and dependency scanning partly compensate.

Workflow auditcaution

The single workflow was fully analyzed with no untrusted checkouts or script injection, but all nine action references are unpinned. The reported cache-poisoning findings have low confidence and therefore remain hygiene concerns rather than severe evidence.