Privacy and Security

Privacy and Security

Where your data goes

Nowhere. Payment data you paste is analyzed in your browser (in a Web Worker) or locally by the CLI.

• No upload, no server-side analysis, no analytics on pasted content.
• The static demo's Content Security Policy allows network requests only to its own origin.
• Nothing you paste is written to browser storage. The theme setting is the only thing remembered.
• The optional admin area (see Self-Hosting) never receives imported payment data.

Redaction

Sensitive data is removed from everything PandaPayLens shows or exports: the raw data view, events, findings and reports.

Removed or replaced	How
card numbers, security codes, expiry, encrypted card fields	blocked field names, plus a Luhn check on values
tokens, API keys, secrets, passwords, signatures, authorization headers	blocked field and header names
names, emails, phone numbers, addresses, IP addresses	blocked field names
prototype keys (__proto__, constructor, prototype)	dropped with a warning

Adapters read the original record locally but copy only allowlisted, non-sensitive fields into events, and provider messages pass through a sanitizer. A final pass over every report removes anything that still looks sensitive, wherever it was planted. These guarantees are covered by property-based tests that plant card numbers, emails and secrets in random places.

Identifier masking

Payment, event, subscription and attempt identifiers are masked by default in all exports (only a short prefix and suffix stay visible). You can include them explicitly (--include-identifiers in the CLI, or the export option in the browser) when you need them for a support ticket.

Webhook signatures

PandaPayLens never verifies signatures and never asks for webhook secrets. A pasted webhook can be edited by anyone, so it is always treated as unverified. Verify signatures in your own system with the provider's SDK.

Input safety

• Hard limits on size, depth, records and string length (see Input Formats).
• A time limit on browser analysis.
• No eval, no dynamic code, no network or storage access in the engine, adapters or rules.
• Provider text is escaped in HTML and Markdown exports. Documentation links are validated.

Reporting a vulnerability

Please report security issues privately through GitHub's private vulnerability reporting, not in public issues. See SECURITY.md.

Synthetic data only

All fixtures and examples are synthetic. Identifiers contain PPLsynth. Please never attach real card, customer or merchant data to an issue; use the masked export instead.