prestashop/ps_checkout

Security policycaution

The linked repository has no published security policy, leaving vulnerability reporting and disclosure expectations unclear for a payment module. This is a transparency gap, although repository tooling shows Sonar security scanning is in use.

Workflow auditcaution

All 6 workflows were analyzed, with no untrusted checkout or script-injection paths, but the audit found high-confidence template-injection findings, overprovisioned secrets, an archived action, and 15 of 15 action references unpinned. The overprovisioned secrets and lack of pinning are concrete supply-chain hygiene concerns; the template-injection and archived-action findings add further maintenance risk.