Expected webhook verification failures are logged at CRITICAL

[gokul-debugger]

Description

Verifier.verify() logs two expected webhook verification failures at CRITICAL level:

• A missing Paddle-Signature header
• A signature timestamp outside the configured variance

In both cases, verification returns False rather than raising an exception. These conditions can occur during ordinary invalid traffic, automated scans, or penetration testing.

Logging integrations may capture these CRITICAL records as actionable incidents even though the verifier handled the rejection successfully.

Reproduction

Using paddle-python-sdk 1.15.0 from a repository checkout:

import logging

from paddle_billing.Notifications import Secret, Verifier
from tests.Utils import FakeRequest

logging.basicConfig(level=logging.INFO)

verifier = Verifier()

print(verifier.verify(FakeRequest({}, ""), Secret("test")))

expired = FakeRequest(
    {"Paddle-Signature": "ts=0;h1=dummy"},
    "",
)
print(verifier.verify(expired, Secret("test")))

Output:

CRITICAL:paddle_billing:Unable to extract the 'Paddle-Signature' header from the request
False
CRITICAL:paddle_billing:Too much time has elapsed between the request and this process
False

Expected behavior

Expected verification failures should not require CRITICAL logging. A lower severity such as WARNING or INFO, or a caller-configurable approach, would allow applications to reject invalid requests without creating critical error alerts.

I would be happy to submit a focused PR with regression tests once the preferred logging behavior is confirmed.