Security

[MarxGames]

My 2 cents:

1. sign_password param should not be sent in the request as this compromises the 'Project password' and opens up possibility to forge fake purchases
2. ss2 param should also be validated as MD5 is very old and not that secure, although SHA1 is not that much better anymore but Paysera does not offer a better solution at this moment
   Public key for SHA1 verification is available here https://www.paysera.com/download/public.key

[dzonatan]

Hi. Thanks for the comments. I haven't used it for my projects in a while and no plans using in the near future. PR would be appreciated.

[MarxGames]

We have made our own integration, but before that we were looking for other integration we stumbled across this and just wanted to put up this warning.

[dzonatan]

First part solved by #4