setono/sylius-quickpay-plugin

Dependency profilecaution

The plugin declares 35 runtime dependencies across Sylius, Symfony, Payum, and Quickpay components. This is a substantial integration surface, but it is consistent with a payment plugin rather than evidence of abandonment by itself.

Repo bus factorcaution

All 94 recent commits came from one contributor, creating a real continuity risk. The organization-owned repository provides some ability to hand off maintenance, but no second active contributor is shown.

Repo toolingcaution

The repository uses Composer build tooling, but no security-scanning tools were detected. That is a transparency and assurance gap, though it does not outweigh the strong maintenance evidence.

Security policycaution

No security policy was found, leaving vulnerability-reporting expectations unclear for a payment integration.

Token permissionscaution

Neither workflow declares top-level token permissions. No workflow requests top-level write access, but explicit least-privilege permissions would provide stronger assurance.