Virgil commented on issue core/php-plug-stock#1

Virgil
Sun, 22 Mar 2026 19:46:48 +0000

[audit] Security, API safety, missing tests, error handling
Codex Audit Findings

HIGH (2)

1. Tagged releases not installable — requires dev-only lthn/php with no stable path (composer.json:8/:15)

2. Download tracking never retries on API failure — job discards Response, 4xx/5xx/429 treated as success (TriggerDownload.php:37, Download.php:43)

MEDIUM (1)

3. Attribution payload insufficient for Unsplash compliance — no referral-ready URLs (Photo.php:67/:76)