tech-andaz/pay-minion

Package file treecaution

The artifact contains a file named easypaisa_private_key.pem alongside payment integrations. Its contents and status are not established here, but bundling a private-key-named file is a material transparency and credential-handling concern.

Repo bus factorcaution

All 6 recent commits came from one contributor, creating a concentrated maintenance dependency and increasing the risk that fixes or reviews stop if that person becomes unavailable.

Repo toolingcaution

The project uses Composer, but no security scanning tools are configured, leaving an important assurance gap for a payment-related package.

Security policycaution

The repository has no security policy, reducing transparency about how vulnerabilities and credential exposure should be reported or handled.

Workflow auditcaution

No GitHub Actions workflows were present, so there were no workflow risks to identify; this also provides no automated build or security assurance.