Tag Info

New answers tagged

0

If you are dealing with a normal merchant, one of the few ways would be to notify their processor, at which point they COULD be charged penalty non compliance fees, but it would depend on a large amount of variables. If you have a CCN stolen and traced back to that location, you can report that to your bank, and to the credit card company that issued your ...


1

No, you would not typically do this though you can walk through much of the .net supporting libraries in a debugger if you want to check exactly what a specific piece of code is doing. You may be able to scan some of the libraries using static code analysis that can operate on binaries but with large reputable vendors they will have already done this or ...


5

Is it standard practice to conduct a security review of Microsoft's own code base when you build an app on the Microsoft stack? No. One reason being is that you will not have access to proprietary (Windows, IIS, .Net, patches) code unless you reverse engineer it and the effort of it would outweigh the benefits. The common approach is to define ...


1

(Disclosure, I work for Braintree, a competitor to Stripe) At Braintree we also allow the CVV code to be passed in our API. You are correct that the PCI-DSS explicitly forbids non-issuers from storing the CVV. You are allowed to hold the code temporarily while waiting for the charge to be authorized. This is stated in PCI-DSS Requirement 3.2 (additional ...



Top 50 recent answers are included