For context, this guy has a history of being dismissive of legitimate security concerns like using unsalted md5 passwords

Also this issue, ooof https://github.com/opencart/opencart/issues/12939

Maybe someone should fork Opencart and patch the security vulnerabilities and try to drive people away from this guy’s repo, since he’s just combative anytime someone raises a concern.

Or quit using his code altogether.