Signifyd client API plugin for PHP
52%
Total Score
caution
Usable with caveats: the SDK targets a deprecated V2 API and recent repository activity has stopped.
The artifact includes a substantial README and tests, and this exact version has GitHub release notes. However, the README explicitly says the V2 SDK and API are deprecated, which materially increases future adoption risk.
The repository recorded zero commits and zero active maintainers in the last 3 months. That is a meaningful maintenance concern for a package developers may need to keep compatible with its service.
There is only one open issue and one open pull request, with no new or closed issues or pull requests in the last month. This indicates limited current project interaction, though the small backlog is not severe on its own.
The repository uses Composer, but no security scanning tools were detected. The missing automated security coverage is a modest transparency and maintenance gap.
No security policy was found in the repository. For an SDK handling payment and fraud-related API data, this leaves vulnerability reporting and response expectations unclear.
| Title | Versions | Severity |
|---|---|---|
AIKIDO-2025-10535 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. signifyd/signifyd-php is vulnerable to Insertion of Sensitive Information into Log File in versions 2.0.0 - 4.1.4. | 2.0.0 - 4.1.4 | Low |
No maintainer information available.
| Dependency | Last Release | Score |
|---|---|---|
monolog/monolog Version >=1.16.0 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.