mahocommerce/module-pensopay

Dangerous workflowscaution

Seven workflows were analyzed and one uses pull_request_target, which warrants care because that trigger can expose elevated workflow context to pull requests. No untrusted checkouts or script-injection patterns were detected.

Repo bus factorcaution

One contributor made all five recent commits, creating a real continuity risk. Organization ownership provides some handoff capacity, but no second active contributor is shown.

Repo commit activitycaution

Five commits were made in the last three months, showing current activity, but all activity came from one maintainer.

Security policycaution

The repository has no published security policy, leaving vulnerability-reporting and response expectations unclear for a payment integration.

Token permissionscaution

Six workflows lack top-level permissions declarations, and one workflow declares write access. Explicit least-privilege permissions would make the build and release process more transparent and safer.