{
  "feature_id": "CHECKOUT-RETURNTO",
  "agent": "security",
  "stage": "security_gate",
  "verdict": "APPROVED",
  "security_check": "security",
  "summary": "Sin cambios de seguridad: returnTo es un query param de redirect interno.",
  "checks": {
    "open_redirect": "OK: returnTo solo se usa con router.push (Next.js client-side), no con window.location ni header Location.",
    "input": "OK: el valor se lee del query param y solo se usa en router.push — no se evalúa ni se concatena a URLs externas."
  },
  "timestamp": "2026-08-26T18:31:35Z"
}
