I've inherited the code-base for a legacy mobile app (both the native Android and native iOS version) and am running a security review on it, a few things stood out to me.
The app allows a user to store their credit card details on the phone for future purchases (note: The CSN number is explicitly not stored as a security measure), when the number is presented again the number is shown masked. The numbers are stored in a hashed/encrypted state (iOS keychain, Android has it as a hashed encrypted value). When making a purchase the credit card info is sent across via a configurable url that uses https.
The app doesn't currently have integration with thrid party credit card handlers (Paypal,Stripe etc).
I'm going to push for all credit card handling to be done via secure third party vendors and am wondering if PCI-DSS standards are being violated here, I've read through the OWASP and PCI-DSS guidelines and nothing seems to be directly breached but it seems to be skirting the edge of doing so.
Credit card storage on a user device just raises red flags to me so I'd like to check if someone else has experienced something similar?