spree-returns

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (medium risk: 0.30). The skill documents post-purchase flows in Spree 6 including returns, exchanges, and claims that handle money back, store credit, refunds, and payment settlements (Spree::Return, Spree::Exchange, Spree::Claim, Returns::Refund, Exchanges::Fulfill, Claims::Resolve). This constitutes a direct financial operation (refunds and payment settlements). Access control for the Admin API endpoints is documented as being gated by permissions (read_orders / write_orders), satisfying the requirement for qualifying independent access control.