Virgil commented on issue core/php-plug-altum#1

Virgil
Sun, 22 Mar 2026 19:40:00 +0000

[audit] Security, API safety, missing tests, error handling
Codex Audit Findings

HIGH (2)

1. Boot fatals — auto-discovery eagerly instantiates verifier but WebhookVerifier interface not in composer.json deps (AltumServiceProvider.php:17, AltumWebhookVerifier.php:27)

2. Webhook verification bypassable — $secret parameter ignored, any request with User-Agent starting 'AltumCode' accepted (AltumWebhookVerifier.php:29)

MEDIUM (1)

3. Test suite not runnable — Facade calls without Orchestra Testbench bootstrap