Download index.html from getreadystack/pci-payment-page-script-audit: direct link, hf CLI and curl.
- Browser
- Download file 48 kB
-
https://huggingface.co/spaces/getreadystack/pci-payment-page-script-audit/resolve/main/index.html
- Command line
-
hf download hf://spaces/getreadystack/pci-payment-page-script-audit/index.html
-
curl -L -o index.html https://huggingface.co/spaces/getreadystack/pci-payment-page-script-audit/resolve/main/index.html
48 kB
| <html lang="en"><meta charset="utf-8"> | |
| <meta name="viewport" content="width=device-width,initial-scale=1"> | |
| <title>PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 on your checkout markup</title> | |
| <meta name="description" content="PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This reads a checkout page and names every script that has no authorization method, no integrity method and no inventory row."> | |
| <style> | |
| :root{color-scheme:light dark} | |
| body{margin:0;font:16px/1.6 system-ui,-apple-system,"Segoe UI",sans-serif; | |
| background:#fbfbfa;color:#16161d} | |
| @media(prefers-color-scheme:dark){body{background:#14141a;color:#e8e8ea}} | |
| .wrap{max-width:880px;margin:0 auto;padding:28px 20px 64px} | |
| h1{font-size:1.7rem;line-height:1.25;margin:.2em 0 .3em} | |
| p.sub{margin:0 0 1.4em;opacity:.8} | |
| textarea{width:100%;min-height:230px;font:13px/1.5 ui-monospace,Menlo,Consolas,monospace; | |
| padding:12px;border:1px solid #c9c9d1;border-radius:10px;background:transparent;color:inherit; | |
| box-sizing:border-box} | |
| button{font:600 15px/1 inherit;padding:12px 22px;border:0;border-radius:10px; | |
| background:#1d4ed8;color:#fff;cursor:pointer;margin:12px 0} | |
| button:hover{background:#1a43bd} | |
| table{border-collapse:collapse;width:100%;margin-top:14px;font-size:14px} | |
| th,td{border-bottom:1px solid #d8d8e0;padding:8px 6px;text-align:left;vertical-align:top} | |
| th{font-weight:600;opacity:.75} | |
| td.n{width:64px;font:13px ui-monospace,monospace;opacity:.7} | |
| .ok{padding:14px;border-radius:10px;background:#e8f5ec;color:#14532d;margin-top:14px} | |
| @media(prefers-color-scheme:dark){.ok{background:#15321f;color:#bbf7d0}} | |
| .next{margin-top:30px;padding:18px;border:1px solid #d8d8e0;border-radius:12px} | |
| .next h2{font-size:1.05rem;margin:0 0 .5em} | |
| .next ul{margin:.3em 0 1em 1.1em;padding:0} | |
| </style> | |
| <div class="wrap"> | |
| <h1>PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 on your checkout markup</h1> | |
| <p class="sub">PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable. This reads a checkout page and names every script that has no authorization method, no integrity method and no inventory row.</p> | |
| <textarea id="src" placeholder="Paste the HTML of your checkout page here"><!doctype html> | |
| <html lang="en"> | |
| <head> | |
| <meta charset="utf-8"> | |
| <meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' https:"> | |
| <title>Checkout - Northwind Store</title> | |
| <script src="https://www.googletagmanager.com/gtag/js?id=G-8QK2M1RS"></script> | |
| <script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}</script> | |
| <script src="https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js"></script> | |
| <script src="https://static.hotjar.com/c/hotjar-2914455.js?sv=6"></script> | |
| <script src="https://js.stripe.com/v3/"></script> | |
| </head> | |
| <body> | |
| <form id="pay" action="/charge" method="post"> | |
| <input name="cardholder" autocomplete="cc-name"> | |
| <input name="cardnumber" autocomplete="cc-number" inputmode="numeric"> | |
| <div id="card-element"></div> | |
| <button type="submit" onclick="track('checkout_submit')">Pay $129.00</button> | |
| </form> | |
| <script src="//assets.northwind-cdn.net/checkout-bundle.js"></script> | |
| <script> | |
| var s = document.createElement("script"); | |
| s.src = "https://connect.facebook.net/en_US/fbevents.js"; | |
| document.head.appendChild(s); | |
| </script> | |
| <script src="https://widget.intercom.io/widget/ab12cd34" async></script> | |
| </body> | |
| </html></textarea> | |
| <button id="go">Audit this payment page</button> | |
| <div id="out"></div> | |
| <div class="next"><h2>In the full version</h2><ul><li>Export the dated 6.4.3 script inventory as CSV, JSON or HTML</li><li>Audit every payment page in the repository in one pass</li><li>Machine output your CI can fail a build on</li><li>Re-audit on every save</li><li><a href="https://getreadystack.com/api/buy/cl/polar_cl_FKoJOcDSLKquM3gnPEkdjzJ89osFHC7TgbEej21i5FQ">Get the full version</a></li></ul></div> | |
| </div> | |
| <script> | |
| var RULES=[{"pattern": "<script(?![^>]*\\bintegrity=)[^>]*\\bsrc=[\"\\']https?://(?!(?:js\\.stripe\\.com|checkout\\.stripe\\.com|www\\.paypal\\.com|js\\.braintreegateway\\.com|pay\\.google\\.com|x\\.klarnacdn\\.net|js\\.squareup\\.com|checkoutshopper-live\\.adyen\\.com))", "flags": "i", "sev": "error", "fix": "integrity=\"sha384-...\" crossorigin=\"anonymous\"", "message": "External script on a payment page with no integrity= attribute. PCI DSS 4.0.1 requirement 6.4.3, mandatory since 2025-03-31, needs a method that assures the integrity of every script the browser executes. Add integrity=\"sha384-...\" crossorigin=\"anonymous\", or record the alternative integrity method in the inventory row for this script."}, {"pattern": "<script(?![^>]*\\bcrossorigin\\b)[^>]*\\bintegrity=", "flags": "i", "sev": "error", "fix": "crossorigin=\"anonymous\"", "message": "integrity= without crossorigin=. The browser cannot run the CORS check, so it refuses the file or ignores the hash - the SRI you wrote proves nothing to an assessor while looking like a control. Add crossorigin=\"anonymous\"."}, {"pattern": "integrity=[\"\\']\\s*sha1-", "flags": "i", "sev": "error", "fix": "integrity=\"sha384-...\"", "message": "SRI accepts sha256, sha384 and sha512 only. A sha1- digest is ignored by every browser, so this script is unprotected while the markup claims otherwise - the worst state to be in when a QSA reads requirement 6.4.3."}, {"pattern": "<script[^>]*\\bsrc=[\"\\']//", "flags": "i", "sev": "warn", "fix": "src=\"https://...\"", "message": "Protocol-relative script URL. It inherits the page scheme, downgrades silently on an http page, and cannot name a fixed origin in your 6.4.3 inventory. Write the full https:// origin."}, {"pattern": "src=[\"\\'][^\"\\']*(?:@latest|/latest/|@\\^|@~)", "flags": "i", "sev": "error", "fix": "pin the exact version + its SRI hash", "message": "The script is pinned to a moving version (@latest, ^, ~). The bytes can change between the day the inventory was signed and the day a customer pays, which is the exact gap requirement 6.4.3 integrity assurance exists to close. Pin the exact version and add its hash."}, {"pattern": "googletagmanager\\.com|/gtag/js|dataLayer\\.push|gtm\\.js", "flags": "i", "sev": "error", "fix": "remove the container from payment pages", "message": "A tag manager on the payment page. Anyone with container access can add a script after your inventory was signed, so the inventory can never be complete. 6.4.3 requires each script to be authorized before it executes - take the container off payment pages, or document a change control that authorizes every tag it can load."}, {"pattern": "static\\.hotjar\\.com|hotjar-|clarity\\.ms|fullstory\\.com|logrocket|smartlook|mouseflow|sessioncam", "flags": "i", "sev": "error", "fix": "exclude the payment page from the recorder", "message": "A session recorder on a page that carries card fields. It reads keystrokes and DOM mutations, so it is in scope for 6.4.3, and if it ever captures the PAN field it pulls the recording vendor inside your cardholder data environment."}, {"pattern": "connect\\.facebook\\.net|fbevents\\.js|analytics\\.tiktok\\.com|snap\\.licdn\\.com|static\\.ads-twitter\\.com|googleads\\.g\\.doubleclick\\.net|/pixel\\.js", "flags": "i", "sev": "error", "fix": "move the pixel to the confirmation page", "message": "A marketing pixel on the payment page. It is third-party JavaScript in the customer browser, so 6.4.3 wants an inventory entry, a written business justification and an integrity method - three things a pixel snippet never ships with. Fire it on the order-confirmation page instead."}, {"pattern": "widget\\.intercom\\.io|js\\.driftt\\.com|embed\\.tawk\\.to|static\\.zdassets\\.com|js\\.hs-scripts\\.com|crisp\\.chat", "flags": "i", "sev": "error", "fix": "load the widget outside the payment page", "message": "A chat or support widget loads and updates its own remote code. Its bytes change without a release on your side, so no SRI hash stays valid and 6.4.3 integrity assurance breaks on the vendor next deploy, silently."}, {"pattern": "createElement\\(\\s*[\"\\']script", "flags": "i", "sev": "error", "fix": "el.integrity = \"sha384-...\"; el.crossOrigin = \"anonymous\"", "message": "This page builds a <script> element in JavaScript. SRI does not apply to a node created this way unless you set the integrity property yourself, and the URL never appears in a scan of the HTML - so it is missing from the inventory too."}, {"pattern": "document\\.write\\(", "flags": "i", "sev": "error", "fix": "append an element you can hash and authorize", "message": "document.write() injects markup after parsing and can pull in a script that no inventory records and no hash covers. Replace it with an element you create, hash and authorize."}, {"pattern": "\\beval\\(|new Function\\(", "flags": "i", "sev": "error", "fix": "remove eval; parse JSON with JSON.parse", "message": "eval() or new Function() executes code that has no URL and no hash, so it can be neither inventoried nor integrity-checked. It also forces unsafe-eval into the CSP, which removes the CSP as a valid 6.4.3 authorization method for the whole page."}, {"pattern": "import\\(\\s*[\"\\']https?://", "flags": "i", "sev": "error", "fix": "self-host the module and hash it", "message": "A dynamic import() of a remote module. A script-element SRI hash does not cover it and a static scan of the HTML cannot see it, so it is invisible to the inventory. Self-host it, or constrain it with script-src and give it an inventory row."}, {"pattern": "\\son(?:click|submit|change|load|error|focus|blur|input|mouseover)\\s*=\\s*[\"\\']", "flags": "i", "sev": "error", "fix": "addEventListener in an authorized script file", "message": "An inline event handler. It runs only if the CSP allows unsafe-inline, and that one keyword disables script authorization for every script on the page. Move the handler into a nonced or hashed file."}, {"pattern": "<meta[^>]+Content-Security-Policy", "flags": "i", "sev": "error", "fix": "send the CSP as an HTTP response header", "message": "The CSP is delivered in a <meta> tag. A meta policy cannot carry report-uri or report-to - the browser ignores both there. PCI DSS 11.6.1 requires an alert when the payment page scripts or headers change, and a meta CSP can block but can never tell you it blocked. Send the header from the server."}, {"pattern": "script-src[^;>]*\\'unsafe-inline\\'", "flags": "i", "sev": "error", "fix": "script-src 'nonce-{random}' 'strict-dynamic'", "message": "unsafe-inline in script-src. Any injected inline script executes, so the CSP stops being a method to confirm that each script is authorized and 6.4.3 has no control left behind it. Replace it with a per-response nonce or sha256 hashes."}, {"pattern": "script-src[^;>]*\\'unsafe-eval\\'", "flags": "i", "sev": "warn", "fix": "drop 'unsafe-eval' from script-src", "message": "unsafe-eval in script-src lets any authorized script run code built from a string, so an attacker who lands one injected line can execute anything without loading a file the inventory would show."}, {"pattern": "script-src[^;>]*(?:\\s\\*[\\s;\"\\']|\\shttps:[\\s;\"\\'])", "flags": "i", "sev": "error", "fix": "list the exact script origins", "message": "script-src allows a wildcard (* or https:). Every host on the internet is authorized, which is the opposite of the 6.4.3 authorization requirement, and it means a skimmer hosted anywhere loads without a CSP violation being raised."}, {"pattern": "Content-Security-Policy-Report-Only", "flags": "i", "sev": "warn", "fix": "run an enforcing policy alongside Report-Only", "message": "Report-Only covers the detection half of 11.6.1 but authorizes nothing: it never blocks. 6.4.3 needs a policy that actually stops an unauthorized script. Keep Report-Only for tuning and ship an enforcing policy next to it."}, {"pattern": "<base\\s[^>]*href", "flags": "i", "sev": "error", "fix": "remove <base> from payment pages", "message": "A <base> element rewrites every relative script URL on this page. One injected attribute moves your own bundle to another host while the HTML still reads exactly the same, and the inventory no longer describes what actually loads."}, {"pattern": "serviceWorker\\.register", "flags": "i", "sev": "warn", "fix": "scope the worker away from the payment path", "message": "A service worker can rewrite the response for the payment page itself, scripts included, out of a cache that no page-level SRI can check. Scope it away from the payment path or record it as an integrity-relevant component."}, {"pattern": "<script(?![^>]*\\b(?:src|nonce|type=[\"\\']application/(?:ld\\+json|json)))[^>]*>", "flags": "i", "sev": "warn", "fix": "nonce=\"{random}\" on the tag, or move it to a hashed file", "message": "Inline script with no nonce and no hash. The only policy that lets it run is unsafe-inline, which voids script authorization for the page. Add a nonce that changes on every response, or move the code into a file you can hash."}, {"pattern": "jquery[-/.]?(?:1\\.|2\\.|3\\.[0-4])[0-9.]*(?:\\.min)?\\.js", "flags": "i", "sev": "error", "fix": "jQuery 3.7.1", "message": "jQuery below 3.5.0 carries CVE-2020-11022 and CVE-2020-11023, HTML-manipulation XSS. On a payment page an XSS is a card-skimming primitive, and requirement 6.3.3 wants a critical patch applied within one month of release."}, {"pattern": "js\\.stripe\\.com|www\\.paypal\\.com/sdk|js\\.braintreegateway\\.com|checkoutshopper-live\\.adyen\\.com|x\\.klarnacdn\\.net|js\\.squareup\\.com", "flags": "i", "sev": "info", "fix": "add an inventory row, no SRI hash", "message": "A payment processor script. These are loaded directly from the vendor with no SRI hash on purpose - the vendor rotates the file - so a linter that demands integrity here is wrong. It still needs a 6.4.3 inventory row whose justification is that it renders the hosted card fields."}, {"pattern": "<iframe[^>]*src=[\"\\']https?://", "flags": "i", "sev": "info", "fix": "confirm the scoping with your acquirer", "message": "A third-party iframe on the payment page. Fully outsourced checkouts used to mark 6.4.3 and 11.6.1 not applicable on a QSA agreement alone; the PCI SSC revised FAQ 1331 on 2026-08-04 so that agreement is no longer sufficient and the acquirer must confirm. Scripts on the parent page stay in scope either way."}, {"pattern": "autocomplete=[\"\\']cc-(?:number|csc|exp)|name=[\"\\'](?:cardnumber|card_number|cvc|cvv)", "flags": "i", "sev": "info", "fix": "render card fields in the processor iframe", "message": "A card field rendered by your own markup rather than the processor iframe. That makes this an SAQ A-EP payment page, so every script on it - analytics and chat included - falls under 6.4.3 and 11.6.1 rather than being out of scope."}]; | |
| function scan(t){var L=String(t).split(/\r?\n/),h=[],i,r,re; | |
| for(i=0;i<L.length;i++){for(var k=0;k<RULES.length;k++){r=RULES[k]; | |
| try{re=new RegExp(r.pattern,r.flags||'')}catch(e){continue} | |
| if(re.test(L[i]))h.push({line:i+1,msg:r.message})}} | |
| return h} | |
| document.getElementById('go').onclick=function(){ | |
| var t=document.getElementById('src').value,o=document.getElementById('out'); | |
| if(!t.trim()){o.innerHTML='';return} | |
| var h=scan(t); | |
| if(!h.length){o.innerHTML='<div class="ok">Every script on this page carries an authorization method and an integrity method. Nothing here fails 6.4.3 or 11.6.1.</div>';return} | |
| var s='<table><tr><th>Line</th><th>Finding</th></tr>'; | |
| for(var i=0;i<h.length;i++){s+='<tr><td class="n">'+h[i].line+'</td><td>'+ | |
| String(h[i].msg).replace(/&/g,'&').replace(/</g,'<')+'</td></tr>'} | |
| o.innerHTML=s+'</table>'}; | |
| </script> | |
| <script> | |
| // ★result_first — 열자마자 ★계산된 결과가 화면에 있어야 한다 (설명·빈 상자 금지). | |
| (function(){var g=document.getElementById('go');if(g)g.click();})(); | |
| </script> | |
| </html> | |
| <section data-yj-install="free" style="margin:2rem auto 1rem;max-width:46rem;padding:1.25rem 1.25rem;border:1px solid #cfe3d6;border-radius:12px;background:#f6fbf8;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .4rem;font-size:1.2rem">Install free</h2><p style="margin:0 0 .8rem;color:#41505f">Free for the file open in your editor - no key, no limit. The workspace sweep and the report ask for a key.</p><a href="https://marketplace.visualstudio.com/items?itemName=ReadyStack.pci-payment-page-script-audit" rel="noopener" data-yj-install-door="mp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pci-payment-page-script-audit',src:'mp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">VS Code Marketplace</a><a href="https://open-vsx.org/extension/readystack/pci-payment-page-script-audit" rel="noopener" data-yj-install-door="ovsx" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pci-payment-page-script-audit',src:'ovsx',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Open VSX (Cursor, VSCodium)</a><a href="https://www.npmjs.com/package/@readystack/pci-payment-page-script-audit" rel="noopener" data-yj-install-door="npm" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pci-payment-page-script-audit',src:'npm',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">npm</a><a href="https://www.npmjs.com/package/@readystack/pci-payment-page-script-audit" rel="noopener" data-yj-install-door="mcp" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pci-payment-page-script-audit',src:'mcp',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">MCP server (npx)</a><a href="https://hub.docker.com/r/getreadystack/pci-payment-page-script-audit" rel="noopener" data-yj-install-door="docker" onclick="try{navigator.sendBeacon('/api/ev',new Blob([JSON.stringify({t:'install',slug:'pci-payment-page-script-audit',src:'docker',path:location.pathname})],{type:'application/json'}))}catch(e){}" style="display:inline-block;margin:0 .5rem .5rem 0;padding:.6rem 1rem;border-radius:8px;background:#0f7b3f;color:#fff;text-decoration:none;font-weight:600">Docker Hub</a><pre style="margin:.5rem 0 0;padding:.6rem .8rem;background:#f3f5f8;border-radius:8px;font-size:.9rem;overflow:auto">ext install ReadyStack.pci-payment-page-script-audit | |
| npx @readystack/pci-payment-page-script-audit <file> | |
| npx @readystack/pci-payment-page-script-audit --mcp</pre><p style="margin:.6rem 0 0;font-size:.92rem;color:#41505f"><a href="https://getreadystack.com/api/buy/cl/polar_cl_l6iN1uWt0FwWu7tBsczD0jWpP2vxFM54Wdwqb3KPi1G" rel="nofollow" style="color:#0f7b3f;text-decoration:underline">Team? One key for every ReadyStack linter, 5 seats, $149 once</a></p></section> | |
| <section data-yj-alert="rule" style="margin:1rem auto 1.5rem;max-width:46rem;padding:1.1rem 1.25rem;border:1px solid #d9dee6;border-radius:12px;background:#fbfcfd;font:15px/1.55 system-ui,-apple-system,Segoe UI,sans-serif"><b style="font-size:1.05rem">Get the full rule table as a PDF</b><div style="opacity:.78;margin:.35rem 0 .8rem">All 26 rules PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 on your checkout markup checks, each with its source and date, on printable pages you can hand to your team or auditor. We email it now, and once more only if a rule changes. No newsletter.</div><div style="display:flex;gap:8px;flex-wrap:wrap"><input id="yjae" type="email" placeholder="you@example.com" style="flex:1;min-width:210px;padding:11px 13px;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:#fff;color:inherit"><button id="yjab" style="padding:11px 18px;border-radius:8px;border:0;cursor:pointer;background:#0f7b3f;color:#fff;font:600 15px system-ui,sans-serif">Email me the PDF</button></div><div id="yjao" hidden style="margin-top:.6rem;color:#0f7b3f">Sent. It arrives within the hour - check spam too.</div><script>(function(){var b=document.getElementById("yjab"),e=document.getElementById("yjae");if(!b||!e)return;b.addEventListener("click",function(){var v=e.value.trim();if(!/.+@.+\..+/.test(v))return;try{localStorage.setItem("yj_em","1");}catch(_){}fetch(location.origin+"/api/subscribe",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({email:v,slug:"pci-payment-page-script-audit",lang:"en",source:"rule_table"+((b.closest&&b.closest("section")&&b.closest("section").getAttribute("data-yj-moved"))?"_at_result":"")})}).then(function(r){var o=document.getElementById("yjao");o.hidden=false;if(!r.ok){o.textContent="Could not save - please try again.";}}).catch(function(){var o=document.getElementById("yjao");o.hidden=false;o.textContent="Could not save - please try again.";});});})();</script><script>(function(){var e=document.getElementById("yjae"),s=e&&e.closest?e.closest("section"):null,o=document.getElementById("out");if(!s||!o)return;var d=false;function mv(ev){if(d)return;if(ev&&ev.target&&s.contains(ev.target))return;d=true;var b=o;while(b.parentNode&&b.parentNode!==document.body&&b.parentNode.tagName!=="MAIN"&&b.parentNode.tagName!=="ARTICLE")b=b.parentNode;if(!b.parentNode||b===s||b.contains(s))return;try{b.parentNode.insertBefore(s,b.nextSibling);s.setAttribute("data-yj-moved","1");}catch(_){}}document.addEventListener("input",mv,true);document.addEventListener("change",mv,true);})();</script></section> | |
| <section data-yj-cta="paid" style="margin:3rem auto;max-width:46rem;padding:1.5rem 1.25rem;border:1px solid #d8dee9;border-radius:12px;background:#fbfcfe;font:16px/1.6 system-ui,-apple-system,Segoe UI,sans-serif"><h2 style="margin:0 0 .5rem;font-size:1.25rem">Get the complete version <span class="yj-price">$29</span></h2><p style="margin:.25rem 0 1rem;color:#41505f">This page is the working piece. The full pack has everything below.</p><p style="margin:0 0 1rem;color:#41505f">PCI DSS 4.0.1 requirements 6.4.3 and 11.6.1 have been mandatory since 2025-03-31, and the PCI SSC revised FAQ 1331 on 2026-08-04 so a QSA agreement alone no longer marks them not applicable.</p><p style="margin:0 0 1rem;color:#5b6b7c;font-size:.94rem">A PCI consultant bills about $76/hour in the US in 2026 (Salary.com, August 2026) and a QSA-assisted SAQ runs $5,000-$20,000; building the script inventory by hand is the part you are paying for.</p><a href="https://getreadystack.com/api/buy/cl/polar_cl_FKoJOcDSLKquM3gnPEkdjzJ89osFHC7TgbEej21i5FQ" rel="nofollow" style="display:inline-block;padding:.7rem 1.3rem;border-radius:8px;background:#1b64f2;color:#fff;text-decoration:none;font-weight:600">Buy the full version — $29</a></section> | |
| <!--yj-share-s101--><div style="margin:28px 0 8px;text-align:center"><button id="yjcp" type="button" style="font:inherit;padding:10px 18px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Copy link</button><button id="yjimg" type="button" style="font:inherit;padding:10px 18px;margin-left:8px;border:1px solid #8884;border-radius:10px;background:transparent;cursor:pointer">Save result as image</button></div><script>(function(){var b=document.getElementById("yjimg");if(!b)return;b.addEventListener("click",function(){var o=document.getElementById("out");var txt=(o&&(o.innerText||o.textContent)||"").trim();if(!txt){b.textContent="(no result yet)";setTimeout(function(){b.textContent="Save result as image";},1500);return;}var lines=txt.split(String.fromCharCode(10)).filter(function(x){return x.trim();}).slice(0,10);var W=1200,P=56,c=document.createElement("canvas");c.width=W;var lh=38,H=P*2+70+lines.length*lh+60;c.height=H;var x=c.getContext("2d");x.fillStyle="#1a1512";x.fillRect(0,0,W,H);x.fillStyle="#f3e9d2";x.font="600 34px system-ui,Segoe UI,Arial";var t=(document.title||"").split("|")[0].trim();x.fillText(t.slice(0,54),P,P+34);x.font="22px ui-monospace,Menlo,Consolas,monospace";x.fillStyle="#e8dcc4";for(var i=0;i<lines.length;i++){x.fillText(lines[i].slice(0,88),P,P+70+i*lh+22);}x.font="600 22px system-ui,Segoe UI,Arial";x.fillStyle="#c9a227";var d=location.hostname.replace("www.","");x.fillText(d,W-P-x.measureText(d).width,H-P+6);c.toBlob(function(bl){var u=URL.createObjectURL(bl),a=document.createElement("a");a.href=u;a.download=(t||"result").replace(/[^a-z0-9]+/gi,"-").toLowerCase()+"-"+d+".png";document.body.appendChild(a);a.click();setTimeout(function(){URL.revokeObjectURL(u);a.remove();},2000);},"image/png");});})();</script><script>(function(){var b=document.getElementById("yjcp");if(!b)return;var t=b.textContent;b.addEventListener("click",function(){var u=location.href.split("#")[0];function d(){b.textContent="Link copied";setTimeout(function(){b.textContent=t;},1800);}if(navigator.clipboard&&navigator.clipboard.writeText){navigator.clipboard.writeText(u).then(d,function(){prompt("",u);});}else{prompt("",u);}});})();</script><div class="yj-home-find"><div class="yj-lgbar"><a href="/" class="yj-lg on">EN</a><a href="/de/" class="yj-lg">DE</a><a href="/ja/" class="yj-lg">JA</a><a href="/es/" class="yj-lg">ES</a><a href="/pt/" class="yj-lg">PT</a></div><section class="yj-find"><h2>Find a tool</h2><input id="yjq" type="search" autocomplete="off" placeholder="Type a product name, format or task"><div id="yjr"></div></section><style>.yj-lgbar{position:absolute;top:14px;right:18px;display:flex;gap:6px;z-index:60}.yj-lg{font:600 12px/1 system-ui,sans-serif;padding:6px 9px;border-radius:4px;text-decoration:none;color:#8b96a3;border:1px solid rgba(140,150,165,.28)}.yj-lg:hover{color:#e8eaed;border-color:rgba(160,175,195,.6)}.yj-lg.on{color:#0e1116;background:#cfd6de;border-color:#cfd6de}.yj-find{max-width:760px;margin:34px auto 8px;padding:0 20px}.yj-find h2{font:600 20px/1.3 system-ui,sans-serif;margin:0 0 10px}#yjq{width:100%;box-sizing:border-box;padding:13px 15px;font:400 15.5px system-ui,sans-serif;border:1px solid rgba(140,150,165,.34);border-radius:8px;background:rgba(255,255,255,.04);color:inherit}#yjq:focus{outline:none;border-color:#7FD1C4}#yjr{margin-top:10px;display:flex;flex-direction:column;gap:6px}#yjr a{display:flex;justify-content:space-between;gap:12px;padding:11px 14px;border:1px solid rgba(140,150,165,.22);border-radius:6px;text-decoration:none;font:400 14.5px/1.4 system-ui,sans-serif;color:inherit}#yjr a:hover{border-color:#7FD1C4}#yjr .pr{font:600 13px system-ui,sans-serif;color:#5fbf9a;white-space:nowrap}</style><script>(function(){var q=document.getElementById("yjq"),r=document.getElementById("yjr"),D=null;function load(){if(D)return Promise.resolve(D);return fetch("/search-index.json").then(function(x){return x.json();}).then(function(j){D=j;return j;}).catch(function(){D=[];return D;});}function esc(t){return String(t).replace(/[&<>"]/g,function(c){return {"&":"&","<":"<",">":">",'"':"""}[c];});}function run(){var v=q.value.trim().toLowerCase();if(v.length<2){r.innerHTML="";return;}load().then(function(j){var w=v.split(/\s+/),o=[];for(var i=0;i<j.length&&o.length<12;i++){var t=j[i].t.toLowerCase();var ok=true;for(var k=0;k<w.length;k++){if(t.indexOf(w[k])<0){ok=false;break;}}if(ok)o.push(j[i]);}r.innerHTML=o.length?o.map(function(x){return "<a href=\""+esc(x.u)+"\">"+"<span>"+esc(x.t)+"</span>"+(x.p?"<span class=\"pr\">$"+x.p+"</span>":"")+"</a>";}).join(""):"";});}q.addEventListener("input",run);q.addEventListener("focus",load);})();</script></div><script data-yj="yj-view-beacon">(function(){try{var p=location.pathname;var k='yjv:'+p;if(sessionStorage.getItem(k))return;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",ref:(document.referrer||''),src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}catch(e){}})();</script> | |
| <script data-yj="yj-use-beacon">(function(){try{var o=document.getElementById('out');if(!o)return;var p=location.pathname,k='yju:'+p,sent=false;function fire(){if(sent||sessionStorage.getItem(k))return;if(!(o.textContent||'').replace(/\s+/g,'').length)return;sent=true;sessionStorage.setItem(k,'1');fetch('/api/ev',{method:'POST',keepalive:true,headers:{'Content-Type':'application/json'},body:JSON.stringify({path:p,lang:"en",t:'use',src:(function(){try{return (new URLSearchParams(location.search).get('ref')||'').replace(/[^a-z_]/g,'').slice(0,12)}catch(e){return ''}})()})}).catch(function(){});}var mo=new MutationObserver(function(){fire();if(sent)mo.disconnect();});mo.observe(o,{childList:true,characterData:true,subtree:true});}catch(e){}})();</script> | |
| <section data-yj="yj-facts-v1" style="max-width:920px;margin:48px auto 0;padding:0 20px;font-family:system-ui,sans-serif"><style>.yj-article p{font:400 15.5px/1.7 system-ui,sans-serif;color:#26313b;margin:0 0 12px;max-width:72ch}.yj-article h2,.yj-article h3,.yj-article h4{font:600 17px/1.35 system-ui,sans-serif;color:#1b1f24;margin:22px 0 8px}.yj-article table{border-collapse:collapse;margin:10px 0 16px;font:14px/1.45 system-ui,sans-serif}.yj-article th,.yj-article td{border:1px solid #e2e6ea;padding:6px 10px;text-align:left}.yj-article th{background:#f4f6f8}.yj-article pre{background:#0f1720;color:#e6edf3;padding:12px 14px;border-radius:8px;overflow:auto;font:13px/1.5 ui-monospace,Menlo,monospace}.yj-article code{font:13px ui-monospace,Menlo,monospace;background:#f1f3f5;padding:1px 4px;border-radius:3px}.yj-article pre code{background:none;padding:0}.yj-article ul,.yj-article ol{font:15px/1.6 system-ui,sans-serif;color:#26313b}</style><p style="font:400 13px/1.5 system-ui,sans-serif;color:#6b7680;margin:0 0 14px"><time datetime="2026-09-08">Updated 2026-09-08</time> · ReadyStack</p><script type="application/ld+json">{"@context":"https://schema.org","@type":"WebPage","dateModified":"2026-09-08","author":{"@type":"Organization","name":"ReadyStack"}}</script><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Worked example</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 16px;color:#5b6570">Real numbers from this tool, line by line.</p><div class="yj-article"><p><img src="https://getreadystack.com/img/promo/sku17800_result_card.jpg" alt="Twenty findings in one checkout page: PCI DSS 6.4.3 on the markup you already shipped" loading="lazy" style="max-width:100%;border-radius:6px"></p> | |
| <p>Twenty findings sit in an ordinary checkout page, and the e-commerce developers who own that template in the US and the EU are the ones who have to clear them. The page renders correctly. Payments go through. Nothing in it looks wrong, because none of these are bugs - they are a requirement that has been mandatory since 2025-03-31 and that nobody put on the sprint board.</p> | |
| <p>PCI DSS 4.0.1 requirement 6.4.3 says that every script loaded and executed in the customer's browser on a payment page needs three things: a method that confirms the script is authorized, a method that assures its integrity, and an inventory entry with a written business or technical justification for why it is there. Requirement 11.6.1 adds that you have to be alerted when the scripts or the security headers of that page change.</p> | |
| <p>Here is the head of a checkout page that passes every other check you run.</p> | |
| <pre><code><meta http-equiv="Content-Security-Policy" content="script-src 'self' 'unsafe-inline' https:"> | |
| <script src="https://www.googletagmanager.com/gtag/js?id=G-8QK2M1RS"></script> | |
| <script src="https://cdn.jsdelivr.net/npm/jquery@latest/dist/jquery.min.js"></script> | |
| <script src="https://static.hotjar.com/c/hotjar-2914455.js?sv=6"></script> | |
| <script src="https://js.stripe.com/v3/"></script></code></pre> | |
| <p>Five lines, and four separate failures:</p> | |
| <ul><li>The policy is in a <code><meta></code> tag. A meta policy cannot carry <code>report-uri</code> or <code>report-to</code> - the browser ignores both there. So it can block, but it can never tell you it blocked, and 11.6.1 asks for exactly that alert.</li><li><code>script-src</code> allows <code>'unsafe-inline'</code> and bare <code>https:</code>. Every host on the internet is an authorized script source, which is the opposite of an authorization method.</li><li>The tag manager can add a script tomorrow that no inventory records. That is not a hypothetical; it is the normal way a marketing tag reaches a checkout page.</li><li><code>jquery@latest</code> is a moving version. Whatever hash you wrote down at assessment time describes bytes that may no longer be served.</li></ul> | |
| <p>And one line that is fine and gets flagged by naive tooling: <code>js.stripe.com</code> is supposed to load without a Subresource Integrity hash, because Stripe rotates that file. Demanding a hash there is wrong. It still needs an inventory row, with "renders the hosted card fields" as its justification.</p> | |
| <h3>The thing that changed this year</h3> | |
| <p>Merchants with a fully outsourced checkout used to have a way out. If the payment page was entirely delivered by the processor, a QSA could agree that 6.4.3 and 11.6.1 were not applicable, and that agreement was enough to write it into the report.</p> | |
| <p>On 2026-08-04 the PCI Security Standards Council published a revised FAQ 1331. QSA agreement alone is no longer sufficient: merchants must consult their Compliance Accepting Entity - the acquirer or the payment brand - to confirm what applies. The requirements did not change. The escape route narrowed, and it narrowed inside an assessment cycle that many teams are already in.</p> | |
| <h3>Why the tools you already have do not cover this</h3> | |
| <p>A CSP evaluator grades the policy string. It never opens your page, so it cannot see the script the page injects at runtime with <code>document.createElement('script')</code>. ESLint reads JavaScript; it does not read the attributes of a <code><script></code> tag, so <code>integrity=</code> with no <code>crossorigin=</code> - which browsers ignore, leaving you unprotected while the markup claims otherwise - goes straight past it. And an assistant that was trained before this year will confidently tell you Subresource Integrity is sufficient for 6.4.3, which is the single most common wrong answer in this area: SRI does not inventory anything, does not apply to dynamically injected scripts, and does not notice when an authorized script starts behaving differently.</p> | |
| <h3>What the audit does</h3> | |
| <p>It reads the page as markup, line by line, against 26 rules written for payment pages specifically. Each finding names the line, the requirement it fails and the replacement. Session recorders on a page with a card field. Marketing pixels that ship without a justification. <code><base href></code>, which quietly rewrites every relative script URL on the page. <code>eval()</code> and <code>new Function()</code>, which force <code>'unsafe-eval'</code> into the policy and remove the CSP as an authorization method for everything else. Inline handlers, which force <code>'unsafe-inline'</code> and do the same.</p> | |
| <p>The free version audits the page you have open, completely: all 26 rules, no key, no watermark, no locked results. It runs in the editor and it runs as a single web page you can paste a template into.</p> | |
| <p>What a licence adds is not more rules - it is the artifact. An assessor does not accept a findings panel; they accept a dated inventory. The full version exports that inventory as CSV, JSON or HTML across every payment page in the repository, and emits CI output that fails a build when an unauthorized script appears, so the next tag someone pastes in does not reach production between assessments.</p> | |
| <p>A PCI consultant bills about $76 an hour in the US in 2026, and a QSA-assisted self-assessment runs $5,000 to $20,000. Building this inventory by hand is billed inside that, and it has to be rebuilt every time marketing adds a tag.</p></div><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:30px 0 10px;color:#1b1f24">15 seconds — what it actually does</h2><video controls muted playsinline preload="none" poster="/img/promo/sku17800_result_card.jpg" style="width:100%;max-width:360px;border-radius:10px;display:block;margin:0 auto"><source src="/media/sku17800_short.mp4" type="video/mp4"></video><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:34px 0 6px;color:#1b1f24">Questions people ask</h2><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What does PCI Payment Page Script Audit actually do?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">It reads the HTML of a checkout page and marks every script that fails PCI DSS 4.0.1 requirement 6.4.3 or 11.6.1. Each finding carries the line number, the requirement it breaks and the fix: a missing integrity hash, a tag manager that can add scripts after your inventory was signed, a policy that only lives in a meta tag. Twenty-six rules ship inside.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Who is this for?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Web and e-commerce developers who own the checkout template, and the security engineer who has to hand a QSA the list of scripts running on the payment page. It is aimed at teams validating under SAQ A-EP or a full Report on Compliance, and at anyone who inherited a checkout page nobody has read since 2024.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why is ESLint, a CSP evaluator or a chatbot not enough?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">A general linter checks syntax; a CSP evaluator reads the policy and never sees the page. Neither knows a payment page is different. They will not tell you that Subresource Integrity is ignored without crossorigin, that a meta policy cannot carry report-uri, or that Stripe's script must load with no hash at all. Those are PCI findings, not code smells.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What is free and what needs a licence?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">Free audits the checkout page you have open against all twenty-six rules, with no key, no watermark and no locked results. That finishes the job for one page. The licence changes what you can take away: the dated script inventory exported as a file, every payment page in the repository, and CI output that fails a build.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">What would this cost if a person did it?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">A PCI consultant bills around seventy-six dollars an hour in the United States in 2026, and a QSA-assisted self-assessment runs from five to twenty thousand dollars. Building the script inventory by hand is billed inside that, and it has to be rebuilt every time marketing adds one tag. The licence is twenty-nine dollars once.</p></details><details style="border-bottom:1px solid #e6e9ed;padding:10px 0"><summary style="cursor:pointer;font:600 15px/1.4 system-ui,sans-serif;color:#1b1f24">Why not just ask ChatGPT or another AI chat?</summary><p style="margin:8px 0 2px;font:400 14.5px/1.6 system-ui,sans-serif;color:#33404b">A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 checks the file you open against 26 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.</p></details><script type="application/ld+json" data-yj="yj-faq-ld">{"@context": "https://schema.org", "@type": "FAQPage", "mainEntity": [{"@type": "Question", "name": "What does PCI Payment Page Script Audit actually do?", "acceptedAnswer": {"@type": "Answer", "text": "It reads the HTML of a checkout page and marks every script that fails PCI DSS 4.0.1 requirement 6.4.3 or 11.6.1. Each finding carries the line number, the requirement it breaks and the fix: a missing integrity hash, a tag manager that can add scripts after your inventory was signed, a policy that only lives in a meta tag. Twenty-six rules ship inside."}}, {"@type": "Question", "name": "Who is this for?", "acceptedAnswer": {"@type": "Answer", "text": "Web and e-commerce developers who own the checkout template, and the security engineer who has to hand a QSA the list of scripts running on the payment page. It is aimed at teams validating under SAQ A-EP or a full Report on Compliance, and at anyone who inherited a checkout page nobody has read since 2024."}}, {"@type": "Question", "name": "Why is ESLint, a CSP evaluator or a chatbot not enough?", "acceptedAnswer": {"@type": "Answer", "text": "A general linter checks syntax; a CSP evaluator reads the policy and never sees the page. Neither knows a payment page is different. They will not tell you that Subresource Integrity is ignored without crossorigin, that a meta policy cannot carry report-uri, or that Stripe's script must load with no hash at all. Those are PCI findings, not code smells."}}, {"@type": "Question", "name": "What is free and what needs a licence?", "acceptedAnswer": {"@type": "Answer", "text": "Free audits the checkout page you have open against all twenty-six rules, with no key, no watermark and no locked results. That finishes the job for one page. The licence changes what you can take away: the dated script inventory exported as a file, every payment page in the repository, and CI output that fails a build."}}, {"@type": "Question", "name": "What would this cost if a person did it?", "acceptedAnswer": {"@type": "Answer", "text": "A PCI consultant bills around seventy-six dollars an hour in the United States in 2026, and a QSA-assisted self-assessment runs from five to twenty thousand dollars. Building the script inventory by hand is billed inside that, and it has to be rebuilt every time marketing adds one tag. The licence is twenty-nine dollars once."}}, {"@type": "Question", "name": "Why not just ask ChatGPT or another AI chat?", "acceptedAnswer": {"@type": "Answer", "text": "A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. PCI Payment Page Script Audit: requirement 6.4.3 and 11.6.1 checks the file you open against 26 rules from a rule set dated 2026-09-20, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files."}}]}</script><div id="yj-ask" style="margin:36px 0 0;padding:18px 18px 16px;border:1px solid #e2e6ea;border-radius:10px;background:#fbfbfc"><h2 style="font:600 19px/1.3 system-ui,sans-serif;margin:0 0 4px;color:#1b1f24">Ask about this tool</h2><p style="font:400 13.5px/1.5 system-ui,sans-serif;margin:0 0 12px;color:#5b6570">One question, answered by the person who built it. Your email only if you want the answer sent.</p><form onsubmit="return yjAsk(event)" style="display:grid;gap:8px"><textarea name="question" required minlength="10" maxlength="2000" rows="3" placeholder="Your question" style="font:14px/1.5 system-ui,sans-serif;padding:10px;border:1px solid #cfd6dd;border-radius:6px"></textarea><div style="display:flex;gap:8px;flex-wrap:wrap"><input type="email" name="email" placeholder="Email (optional)" style="flex:1;min-width:200px;font:14px system-ui,sans-serif;padding:9px 10px;border:1px solid #cfd6dd;border-radius:6px"><button type="submit" style="font:600 14px system-ui,sans-serif;padding:9px 18px;border:0;border-radius:6px;background:#1b1f24;color:#fff;cursor:pointer">Send</button></div><p id="yj-ask-msg" style="font:13px system-ui,sans-serif;margin:2px 0 0;color:#0a6238;min-height:1em"></p></form><script>function yjAsk(e){e.preventDefault();var f=e.target,m=document.getElementById("yj-ask-msg");m.style.color="#0a6238";fetch(location.origin+"/api/ask",{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify({sku:17800,slug:"pci-payment-page-script-audit",lang:"en",question:f.question.value,email:f.email.value,page:location.pathname})}).then(function(r){if(!r.ok)throw 0;m.textContent="Thanks \u2014 noted. Answers land on this page and, if you left an email, in your inbox.";f.question.value="";}).catch(function(){m.style.color="#a8551f";m.textContent="Could not send. Please try again in a minute.";});return false;}</script></div></section><section class="yj-related" style="max-width:920px;margin:56px auto 40px;padding:0 20px"><h2 style="font:600 21px/1.3 system-ui,sans-serif;margin:0 0 6px;color:#1b1f24">Same job, next tool</h2><p style="font:400 14.5px/1.5 system-ui,sans-serif;margin:0 0 20px;color:#5b6570">Free in the browser. The full version is a one-time licence.</p><div style="display:grid;grid-template-columns:repeat(auto-fill,minmax(250px,1fr));gap:14px"><a class="yj-rel-c" href="https://getreadystack.com/tools/personal-data-map-dsar-audit"><span class="yj-rel-t">Personal Data Map: find every column a GDPR subject access request has to reac</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/python-pci-log-leak-lint"><span class="yj-rel-t">Python Log Leak Lint: PCI DSS Card Data</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/soup-list-lint"><span class="yj-rel-t">SOUP List Lint (IEC 62304)</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/sql-card-data-lint"><span class="yj-rel-t">SQL Card Data Lint (PCI DSS Req 3)</span><span class="yj-rel-p">$29</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/webflow-restaurant-template"><span class="yj-rel-t">Webflow Restaurant Template — delivered as self-contained HTML you own: 26 pag</span><span class="yj-rel-p">$49</span></a><a class="yj-rel-c" href="https://getreadystack.com/tools/bnpl-disclosure-lint-ccd2"><span class="yj-rel-t">BNPL Disclosure Lint - EU CCD2 2026</span><span class="yj-rel-p">$29</span></a></div><style>.yj-rel-c{display:flex;flex-direction:column;gap:8px;padding:15px 16px;border:1px solid #e2e6ea;border-radius:6px;text-decoration:none;background:#fff}.yj-rel-c:hover{border-color:#b9c2cb;background:#fafbfc}.yj-rel-t{font:500 14.5px/1.42 system-ui,sans-serif;color:#1b1f24}.yj-rel-p{font:600 13px system-ui,sans-serif;color:#0a6238}</style></section> |