Payment Data Stored Locally
Storing full card numbers, CVVs, or PANs in localStorage, sessionStorage, or your own database violates PCI DSS and creates massive liability.
How It Works
PCI DSS (Payment Card Industry Data Security Standard) forbids storing CVVs after authorization and imposes strict requirements on card number storage. Storing raw card data in localStorage is especially dangerous — any JavaScript on your page (including third-party scripts) can read it. Use Stripe, Braintree, or another tokenization service instead.
// BAD: storing card data in client storage or your own DB
localStorage.setItem('savedCard', JSON.stringify({
number: '4111111111111111',
cvv: '123',
expiry: '12/25'
}));
// Also bad: storing full card numbers in your database// GOOD: use Stripe Elements — card data never touches your servers
import { CardElement, useStripe } from '@stripe/react-stripe-js';
// Card data goes directly from browser to Stripe
// You only receive a paymentMethodId token
const { paymentMethod } = await stripe.createPaymentMethod({
type: 'card',
card: cardElement
});
// Store paymentMethod.id in your DB — not card dataReal-World Example
Ticketmaster's 2018 breach exposed 40,000 payment cards partially because a third-party chatbot script had access to the checkout page where card data was present in the DOM. Proper Stripe Elements iframe isolation would have prevented this.
How to Prevent It
- Never store card numbers, CVVs, or full PANs anywhere — not in your DB, not in localStorage
- Use Stripe Elements or Braintree hosted fields — card data never enters your JavaScript context
- Store only the Stripe customer ID and payment method ID in your database
- If you must handle card data, achieve PCI DSS compliance — it's expensive and complex, use a tokenization service instead
Affected Technologies
Data Hogo detects this vulnerability automatically.
Scan Your Repo FreeRelated Vulnerabilities
No Privacy Policy
lowOperating without a privacy policy violates GDPR, CCPA, and similar regulations — and makes users rightfully distrust your handling of their data.
No Terms of Service
lowWithout terms of service, you have no legal basis to restrict abuse, terminate accounts, or limit your liability for user-generated content.
No Account Deletion
mediumNot offering account deletion violates GDPR's right to erasure and CCPA's right to delete — and is a significant privacy red flag for users.
No Cookie Banner
lowSetting non-essential cookies without user consent violates GDPR and ePrivacy Directive requirements for EU users.