Source code
Security & compliance
PCI/card-data handling
Part of the Payment safety check · fix arrives as a guide
What it is
Raw card details — number, CVC, expiry — pass through your servers rather than going directly from the browser to the payment provider.
Why it matters
The moment card data touches your infrastructure, your PCI DSS scope expands from a short self-assessment to a substantially harder one, and every log, crash dump, and backup becomes in scope with it.
How to fix it
Use the provider's hosted fields or checkout so card data goes from the customer's browser to the provider and you only ever handle a token. Confirm no logging or error-reporting middleware sits in front of that path.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.