spree-api-v3

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents the Spree v3 REST API surfaces (Store and Admin APIs), including payment and refund administration endpoints and scopes (read_payments, write_payments, read_refunds, write_refunds). These represent direct financial operations (processing payments/refunds). Independent access controls are documented and enforced by the service/execution layer via secret keys with scopes (ScopedAuthorization) or JWT admin tokens with CanCanCan abilities (Spree::Ability), as well as publishable keys and JWTs for store APIs.