pci-compliance
Implement PCI DSS compliance for payment security
Auch verfĂĽgbar von: wshobson
Secure payment processing requires meeting PCI DSS standards. This skill provides comprehensive guidance on encryption, tokenization, access controls, and audit logging to protect cardholder data.
Die Skill-ZIP herunterladen
In Claude hochladen
Gehe zu Einstellungen → Fähigkeiten → Skills → Skill hochladen
Einschalten und loslegen
Teste es
Verwendung von "pci-compliance". What data can I legally store after a payment is processed?
Erwartetes Ergebnis:
- You CAN store (if encrypted): Primary Account Number (PAN), cardholder name, expiration date, service code.
- You CANNOT store: Full magnetic stripe track data, CVV/CVC codes, PIN or PIN blocks.
- Best practice: Use tokenization to avoid storing PAN entirely - let your payment processor handle sensitive data storage.
Verwendung von "pci-compliance". How do I reduce my PCI compliance scope?
Erwartetes Ergebnis:
- Use hosted payment pages (SAQ A - minimal requirements)
- Implement client-side tokenization with Stripe.js or similar
- Never transmit card data through your servers
- Segment your network to isolate any systems that touch card data
- Outsource payment processing to PCI-certified providers
Sicherheitsaudit
SicherAll static analysis findings are false positives. The detected 'backtick execution' patterns are markdown code fence syntax (```), not shell commands. The 'env_access' and 'sensitive' detections reference placeholder values in educational code examples. This skill is documentation teaching secure payment handling practices including encryption, tokenization, and access control - promoting security rather than introducing risks.
Qualitätsbewertung
Was du bauen kannst
Payment System Development
Developers building payment processing systems can use this skill to implement PCI-compliant data handling, encryption, and tokenization from the start.
Compliance Audit Preparation
Security teams preparing for PCI DSS assessments can use the checklists and requirements documentation to identify gaps and remediation needs.
E-commerce Integration
Teams integrating payment gateways can learn how to minimize PCI scope using hosted payment pages and tokenization strategies.
Probiere diese Prompts
Explain the 12 PCI DSS requirements and which ones apply to my e-commerce store that uses Stripe Checkout.
Show me how to encrypt cardholder data at rest using AES-256 in Python, including key management best practices.
Compare Stripe tokenization versus building a custom token vault. What are the PCI scope implications of each approach?
Create a PCI-compliant audit logging system that tracks all access to payment data, including the required fields and log retention policies.
Bewährte Verfahren
- Never store CVV, PIN, or full track data under any circumstances
- Use TLS 1.2 or higher for all data transmission involving cardholder information
- Implement role-based access control and log all access to payment data
Vermeiden
- Logging full card numbers or CVV codes in application logs
- Using weak encryption algorithms like DES or RC4 for cardholder data
- Sending card data to your own server instead of directly to the payment processor