magmodules/magento2-boxo-hyva-checkout

Release historycaution

This is the package's first release, published 0 days ago, so there is no release history or cadence to demonstrate long-term maintenance. Its newness is not evidence of abandonment by itself.

Security policycaution

The repository has no security policy, leaving vulnerability-reporting expectations undocumented. This is a modest transparency gap for a new package, with GitGuardian scanning providing some compensating security practice.

Workflow auditcaution

Both workflows were fully analyzed with no detected audit findings or untrusted checkout and script-injection paths. However, all 11 action references are unpinned and one workflow grants top-level write permissions, creating a manageable supply-chain hygiene concern.