skills.rest
exilonX
exilonXCOMMUNITY
Explore all skills by this author →
GitHub

payment-pci-security

Enforce PCI DSS compliance for payment connectors using Secure Proxy routing.

Updated Mar 27, 2026
Search Tags:#data protection#tokenization#pci dss#vtex io#secure proxy#payment authorization#sensitive logging
One-click install
npx skills add https://github.com/exilonX/ap2 --skill payment-pci-security-exilonx
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: payment-pci-security
Source: https://github.com/exilonX/ap2/tree/main/.agents/skills/payment-pci-security
Command: npx skills add https://github.com/exilonX/ap2 --skill payment-pci-security-exilonx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

It prevents payment connectors from violating PCI DSS by incorrectly handling credit/debit card data, Secure Proxy routing, logging, and storage during authorization flows.

Core Features & Use Cases

  • Secure Proxy routing for non-PCI environments: Ensures connectors hosted outside PCI environments (including VTEX IO apps) must use secureProxyUrl and forward correctly to the acquirer with required X-PROVIDER-Forward-* headers.
  • Authorization-only Secure Proxy constraint: Clarifies that Secure Proxy applies only to Create Payment (card authorization) and not to cancel/capture/refund, which must use direct PSP API calls.
  • Card data handling guardrails: Enforces strict rules to store only safe metadata (e.g., card.bin, card.numberLength, card.expiration) and to never store or log raw card details or token values.

Quick Start

Use this skill to audit or implement your payment connector’s Create Payment handler so that it routes via secureProxyUrl in non-PCI contexts while keeping raw card data out of storage and logs.

Frequently Asked Questions about payment-pci-security

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I keep credit card data PCI DSS compliant when building a VTEX IO payment connector?▼

To keep credit card data PCI DSS compliant in VTEX IO, route Create Payment authorizations through a Secure Proxy using `secureProxyUrl` and required forwarding headers, ensuring raw card PAN, CVV, and tokens are never logged or stored.

Can I use the Secure Proxy for post-authorization operations like capture, cancel, or refund?▼

No, the Secure Proxy cannot be used for post-authorization operations like capture, cancel, or refund. It applies strictly to Create Payment card authorization, meaning subsequent operations must use direct PSP API calls.

What card metadata is safe to store without violating PCI DSS requirements?▼

Safe card metadata to store without violating PCI DSS includes non-sensitive details like `card.bin`, `card.numberLength`, and `card.expiration`. You must never store or log raw card PAN, CVV, holder data, or token values.

How do Secure Proxy routing and X-PROVIDER-Forward-To headers work for payment authorization?▼

Secure Proxy routing works by having non-PCI environments use `secureProxyUrl` to forward payment authorization requests to the acquirer. This requires setting correct `X-PROVIDER-Forward-To` and related forwarding headers to ensure secure delivery.

Do I need a PCI-certified environment to process credit card authorizations?▼

You do not need a PCI-certified environment to process credit card authorizations if you route requests through the Secure Proxy. Non-PCI callers, including VTEX IO apps, must use `secureProxyUrl` with proper forwarding headers to stay compliant.

Why does my payment connector fail PCI DSS audits for tokenization and sensitive logging?▼

Payment connectors fail PCI DSS audits when they log or store raw card data and token values. Connectors must enforce strict rules to only store safe metadata and route non-PCI authorization requests through the Secure Proxy.

Related Skills

Explore More Legal & Compliance Skills→
exilonXexilonX

payment-provider-framework

Implement VTEX IO payment connectors with PaymentProviderService and configuration validation.

Community
Advanced
aisa-groupaisa-group
90

paypal-integration

Integrate PayPal REST APIs for checkout, subscriptions, IPN verification, and refunds.

Official
Advanced
vtexdocsvtexdocs
39

payment-pci-security

Enforces PCI-compliant card data handling and Secure Proxy routing for VTEX payment connectors.

Official
Advanced
vtexvtex
39

payment-pci-security

Route tokenized card data through a Secure Proxy for PCI DSS compliance.

Official
Advanced