justpush/prestashop-module-notify

Release historycaution

This is the package's first and only release, published less than one day ago. That is consistent with a new project but provides no longer-term maintenance record.

Repo package mentioncaution

The repository name does not match the package name and its README does not mention the package, so the collected source cannot clearly establish that it is the package's intended repository.

Repo toolingcaution

Composer is used for the build, but no security-scanning tool was detected. That is a modest transparency and maintenance gap for a module handling shop events and webhook configuration.

Security policycaution

The source repository has no security policy, leaving vulnerability-reporting expectations unspecified.

Workflow auditcaution

Both workflows were fully audited with no dangerous sinks or reported findings, but all five action references are unpinned and one workflow grants top-level write permissions. No untrusted trigger connects those permissions to external input, so this is a hygiene caution rather than a severe risk.