SSL/TLS 1.2+ is enforced for all cardholder data in transit

PCI-DSS 4.0 Req 4.2.1 prohibits transmitting PANs over end-user messaging technologies or unprotected open networks; Req 4.1 requires a targeted risk analysis for any TLS configuration below 1.2. Transmitting cardholder data over HTTP or TLS 1.0/1.1 exposes it to BEAST, POODLE, and CRIME class attacks — protocol-level attacks that allow passive decryption. CWE-319 (Cleartext Transmission) is exploitable at any network vantage point on the path. OWASP A02 (Cryptographic Failures) and NIST SC-8 both require encryption in transit as a baseline control. Incomplete enforcement — HSTS present but no redirect from port 80 — leaves a real downgrade path.

Enforce HTTPS at the infrastructure layer, not just in application code. Set HSTS with a max-age of at least 31536000 and add an explicit HTTP-to-HTTPS redirect so there is no cleartext fallback path. For Next.js on Vercel, add to next.config.js:

const securityHeaders = [
  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' }
];

For nginx, set ssl_protocols TLSv1.2 TLSv1.3; and include a listen 80 block that returns 301 before any content is served. Use Let's Encrypt via Certbot or your hosting provider's managed certificates (AWS ACM, Vercel auto-TLS) for automatic renewal — manual certificates expire silently.