Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data?
How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find?
Can I store your SSN in plain text in a text file? Why not?
The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket policy be for all these driver's license photos - there are so many???
So you don't need to know anything about credit cards for someone to enter it into an app? I don't get the take (is it bad sarcasm?)
To be fair, for the vast majority of cases, no you don't.
It is extremely rare for companies to roll their own payment processing anymore, or even handle PCI scope at all.
Credit card entry, I think you should know a few basics like don't put it in MongoDB?? Or nah? It's just like any other user data?
How about a background check - can anyone take a user-entered DL and randomly Google stuff to see what they find?
Can I store your SSN in plain text in a text file? Why not?
The user had to upload their ID for IDV but I use Vercel. I guess I have to put it on S3. What should the bucket policy be for all these driver's license photos - there are so many???
2 replies →
To your last question about bucket policies, clearly you just need to scope it down: arn:aws:sts::*:assumed-role/trustme*/*
(indeed that first wildcard means any account)