openalice-mollie

Payments-SDK security centers on webhook HMAC verification, exhaustively tested (mismatch, malformed non-hex, missing prefix, single-byte-diff implying constant-time compare, empty-secret/not-configured, real-world fixture) plus API-key validation; deny.toml gates supply-chain advisories/licenses; SSRF/rate-limit/headers are N/A for a client lib. Minor smell: MOLLIE_WEBHOOK_SECRET declared but unused (env drift).

~17 integration tests across client_test.rs + webhook_test.rs with heavy coverage of the critical security path (9 webhook-signature cases incl. edge/fixture) plus serde round-trips and key validation; avg complexity 1.80, no coverage % reported and HTTP-call paths (timeouts/retries) appear untested.

Excellent manifest (valid, 100) and 20 @feature annotations, AGENTS.md present, but 41 missing docstrings across a public SDK surface is a real gap and the README is thin (excerpt is just an Atlas-card link), so the consumer-facing API documentation undercuts otherwise strong metadata.

Typed error handling is present and tested (missing-key, mismatch, malformed, not-configured variants) and complexity is low (avg 1.80), but no evidence of HTTP timeouts, retry/backoff, or idempotency keys on payment calls — critical for a billing client — so reliability of the network path is unverified.

Stateless SDK owns no tables, no migrations, no RLS/FK/GDPR surface — axis largely N/A; only data modeling is serde DTOs (amount/customer serialize, payment & webhook payload deserialize) which are tested, but no persistence concerns to evaluate, graded conservatively.

No metrics, tracing spans, or structured-logging signal anywhere in the SDK; manifest exposes no health endpoint (expected for a library). Instrumentation of payment/webhook flows appears absent — graded conservatively as no observability evidence was provided.