Card details are not logged in browser console or analytics events

Logging a full Stripe error object or a payment form's event.target captures card BIN data, error responses that reference card numbers, and provider-internal identifiers — all of which end up in browser consoles, error tracking tools, and analytics pipelines. PCI-DSS 4.0 Req 3.3 prohibits retaining sensitive authentication data; CWE-312 (Cleartext Storage of Sensitive Information) and CWE-532 (Insertion of Sensitive Information into Log File) both apply. OWASP A09 (Security Logging and Monitoring Failures) captures the dual failure: bad logging that records sensitive data while simultaneously failing to record operationally useful signals. A Sentry breadcrumb that captures form data can expose card numbers in your error dashboard to any team member with access.

Log structured error codes only — never raw error objects, form values, or full Stripe response objects.

// WRONG — full error object may contain card details
console.log('Payment failed:', error)
analytics.track('payment_failed', { error })

// CORRECT — log only the code and type
console.error('Payment failed', { code: error.code, type: error.type })
analytics.track('payment_failed', {
  error_code: error.code,    // e.g., 'card_declined'
  error_type: error.type,    // e.g., 'card_error'
})

If you use Sentry, add a beforeSend filter in your sentry.client.config.ts to strip request.data from events originating on checkout routes. Never pass error, event.target, or any form-derived object directly to a logging or analytics call.