bitpay/module-bpcheckout

Repo toolingcaution

The project uses Composer, but no security scanning tool was detected. The missing scanning is a modest transparency and maintenance concern rather than evidence of unsafe code.

Security policycaution

No repository security policy was found, leaving vulnerability reporting and response expectations undocumented.

Workflow auditcaution

Both workflows were analyzed without trigger or secret-handling findings, and one scopes permissions at job level. However, all 12 action references are unpinned, which weakens build reproducibility and update safety.