shopware6

The fragment does not show intentional malware or supply-chain sabotage. The primary security defect is the unauthenticated /shopware/confirm endpoint, which accepts and persists API credentials based only on a caller-supplied shopId. Add authenticated confirmation verification and bind it to the preceding registration, validate payloads and shop existence, and protect the Admin API request with strict HTTPS URL validation and redirect controls. Also reject unknown webhook shops and minimize the high-impact permissions shown in the example.