According to PCI standard all businesses that store, process or transmit payment cardholder data must be PCI Compliant.
Taking into account that we are talking about a bank, fields like card number and card holder's name should be obfuscated when displayed on the screen.
What about the URL of the request? Is it acceptable to have a request like:
Where the card number appears as a path variable? (this is visible via F12-->
Network tab- Not on the screen).
What about the case the card number appears on the request payload:
What about the Network Tab (F12), is it acceptable for the fields to appear raw there, while they appear obfuscated on the screen?
Regardless of the PCI standard, should the e-mail, tax id, physical addresses appear raw on screen? For security reasons, since this is sensitive information, they should be at least obfuscated. What about the Network Tab (F12)? Is it for the fields to appear there raw?