Source code Security & compliance

PCI/card-data handling

Part of the Payment safety check · fix arrives as a guide

What it is

Raw card details — number, CVC, expiry — pass through your servers rather than going directly from the browser to the payment provider.

Why it matters

The moment card data touches your infrastructure, your PCI DSS scope expands from a short self-assessment to a substantially harder one, and every log, crash dump, and backup becomes in scope with it.

How to fix it

Use the provider's hosted fields or checkout so card data goes from the customer's browser to the provider and you only ever handle a token. Confirm no logging or error-reporting middleware sits in front of that path.

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.