Developers who build e-commerce checkout pages and payment integrations play a crucial role in protecting card data. Vulnerabilities in code have allowed attackers to inject skimming scripts, access databases, and steal payment information that ended up in markets like Brians Club. Secure coding practices reduce these risks.
Avoid Handling Card Data
The most effective step is to avoid handling card data directly. Use payment provider integrations such as hosted payment pages, embedded iframes, or client-side tokenization libraries. These approaches ensure that card numbers are sent directly from the customer’s browser to the payment provider, never passing through or being stored on the merchant’s servers.
When integrating payment providers, follow their official documentation and use their maintained libraries. Keep these libraries updated.
Input Validation and Script Protection
Validate and sanitize all input. Injection attacks, such as SQL injection and cross-site scripting, can allow attackers to access data or inject malicious scripts. Use parameterized queries for database access and encode output appropriately.
Protect against cross-site scripting particularly carefully, since it can be used to inject skimming code into pages. Use frameworks that automatically encode output, and implement Content Security Policy to restrict script sources.
Dependencies, Scripts, and Secrets
Manage dependencies. Modern web applications rely on many third-party packages. Use dependency scanning tools to identify known vulnerabilities, and update packages regularly. Be cautious about adding new dependencies, especially to checkout pages.
Control third-party scripts. Limit scripts on payment pages to those that are essential. Use Subresource Integrity to verify that external scripts have not been modified, where feasible.
Protect secrets. API keys, payment gateway credentials, and database passwords should never be hard-coded or exposed in client-side code or public repositories. Use secure secret management and rotate credentials regularly.
Authentication, Logging, and Testing
Implement proper authentication and session management. Protect customer and admin accounts with strong authentication, secure session handling, and protection against brute force attacks.
Log securely. Ensure logs do not capture card numbers, security codes, or passwords. Debug logging in production has led to sensitive data exposure in past incidents.
Use security testing. Incorporate static analysis, dynamic testing, and code review into development processes. Conduct penetration testing before major releases.
Follow secure development frameworks and guidelines, such as those from reputable security organizations, which list common web application vulnerabilities and mitigations.
PCI DSS includes requirements for secure software development, including training developers, reviewing code, and addressing common vulnerabilities.
Developers should stay informed about emerging threats, such as new skimming techniques and supply chain attacks.
The card data stolen from online stores and sold on Brians Club often resulted from coding and configuration weaknesses. Secure coding practices help ensure that checkout pages protect customers rather than expose them.