Payment processing uses a PCI-compliant provider

Collecting raw card numbers, CVV, or expiry dates in your own form and submitting them to your server puts you directly in scope for PCI DSS compliance (pci-dss:4.0 Req 4.2.1, Req 6.4.3). That compliance burden means annual audits, penetration tests, and strict infrastructure controls — or, if you skip it, catastrophic liability when a breach occurs. OWASP A05 (Security Misconfiguration) covers exactly this failure mode: trusting that a payment provider SDK is installed is not the same as using it. Every payment flow that touches raw card data on your server is an exposure vector.

Replace any custom card input fields with your payment provider's hosted element. Card data must go directly to the provider's domain — your server should only ever receive opaque tokens or session IDs.

For Stripe, swap the custom form for PaymentElement:

import { Elements, PaymentElement, useStripe, useElements } from '@stripe/react-stripe-js'

// Card data is captured by Stripe's iframe — never touches your server
// Your API receives only the paymentIntentId returned by stripe.confirmPayment()

Verify the fix by opening your browser's network tab during checkout: card field submissions should go to api.stripe.com, not your own domain.