Payments Preflight · Check 14 of 15
Log payments without card data or secrets
Collect cards with Checkout or Elements so card numbers never touch your server, and log Stripe object ids, not full payloads, keys or secrets.
What it is
Logging that helps you debug payments using ids such as cs_, pi_, in_ and evt_, without storing sensitive data.
Why it matters
Anyone who processes, transmits or stores card data must comply with PCI DSS. Logs are also copied to many tools, so a secret key or customer data in a log line spreads quickly.
How to check
- Confirm card details are collected only by Stripe Checkout, Elements or another Stripe-hosted field, never your own inputs.
- Search for
console.log(event)or logging of full request bodies in payment routes. - Search logs and error tracking for
sk_live_,whsec_andclient_secret.
How to fix it
- Use Stripe-hosted card collection. Stripe returns card brand, last four digits and expiry, which you may store.
- Log event id, type, object id and your user id. Not the whole object.
- Scrub secrets and personal data in your error tracker settings.
console.info("stripe_event", { id: event.id, type: event.type, object: (event.data.object as { id?: string }).id });Prompt for your AI coding tool
Paste into Cursor, Claude Code, Lovable or similar. Review the diff before you accept it.
Audit logging in my payment code. Find every place that logs a full Stripe event, request body, API key, webhook secret or client_secret, and replace it with a log of event id, type, Stripe object id and our user id. Confirm card details are only collected by Stripe Checkout or Elements. Show the diff.
Sources
- Integration security guide Stripe docs
Related checks
Sponsor this page: get in touch.