Multi-gateway consistency

Verifies

When more than one payment gateway is integrated, each one tokenises on the client (or uses the gateway's hosted checkout), keeps raw card data off the server and verifies its webhook signatures. No AI engine is involved: the verdict is reproducible from the source alone.

Inputs

Non-test code files of the checkout (JavaScript, TypeScript, Python, PHP), analysed statically (tokens, function units, calls, imports, route registrations of Next, Express, Fastify, Koa, Hono, Nest, Lambda, Django, Flask, FastAPI and Laravel). Files are attributed to each gateway by SDK, namespace, API host or path. Per gateway three facts are established: raw card handling in its server files (the rules of gateway-tokens-only 1.1.0: a server function reading the PAN or the verification code out of the request, or passing a raw card to a gateway SDK call); its webhook handlers (the rules of webhook-signature-verified 1.1.0: a FUNCTION that receives a request of the provider, verified in its body or through its call graph within 3 module hops); and a client-side tokenisation or hosted-checkout signal (the gateway SDK in browser code — Elements, hosted fields, drop-in, Buttons, bricks — or a checkout session, preference, order or payment link created for the gateway's hosted page). Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed. Nothing of the checkout is executed.

Decision rule

A file is judged SERVER only with proof of its own runtime or of the import graph: the language (Python, PHP), a `server-only` import or a `'use server'` directive, a location the framework declares as server (route.ts, middleware, pages/api, app/api, *.server.*, +server, wsgi/asgi), a Node built-in or server-only package, an HTTP response sink or a Lambda handler export, importing a module that is itself proven to run on a server, or a server folder by framework convention. It is judged BROWSER when it declares `'use client'` or imports `client-only`, when its code touches the DOM, a Web Worker scope, `new Worker(`, a React client hook or a browser-environment polyfill, when a client-declared file of the checkout imports it, when it sits in a browser folder by convention, or when it only uses a Web API the browser serves (`crypto.subtle`, `globalThis.crypto`, `CryptoKey`, `new Blob`, `atob`) with no server evidence at all. NEITHER is NOT server: the shared layer of a monorepo is never accused on a folder name, and the trace says the layer is unproven. `workers/` is not a server folder (a worker folder is a browser convention as often as a server one). Not applicable with fewer than two gateways referenced in the code (the reason names the single gateway when there is one). FAIL (HIGH, with the line) when any gateway has a server function that reads the PAN or the verification code out of the request or passes a raw card to a gateway SDK call, or a webhook handler of that gateway with no provider verification API, no HMAC over the body, no constant-time comparison and no signature or token header comparison in the handler or the functions it calls within 3 module hops. A card gateway with no client-side tokenisation or hosted-checkout signal in any of its files is MEDIUM (blocks in this Extended suite); crypto rails (NOWPayments, Coinbase Commerce, Bitfinex) carry no card and are exempt from that rule. PASS when every gateway follows the pattern; the summary states, per gateway, its files, the tokenisation evidence (file), the raw-card sites and each webhook handler with where it verifies. Not judged by this check (declared): idempotency of the gateway calls, secrets shared between gateways, a loose (non-constant-time) comparison inside an otherwise verified handler (webhook-signature-verified reports it), reads of the expiry alone, and whether a gateway referenced only by configuration is actually wired into the checkout flow.

Type

deterministic

1.1.3: WHERE A FILE RUNS is decided from the FILE (and, when the file alone does not say, from the import graph of the checkout), never from a list of folder names of one particular repository, and a file whose server nature is UNPROVEN is never reported as server code. A monorepo has a SHARED layer — a package the browser bundle and the services both import — and the old rule read every ambiguous file as server: WebCrypto of the browser (`crypto.subtle` in a shared e2ee service that a client component imports) came out as "key generation in server code", once per product sharing the layer. The evidence is now, strongest first: the language (Python, PHP); a `server-only`/`client-only` import or a `'use server'`/`'use client'` directive; a location the framework declares as server (route.ts, middleware, pages/api, app/api, *.server.*, +server, wsgi/asgi); a browser runtime in the code (DOM member, Web Worker scope, `new Worker(`, a React client hook, a browser-environment polyfill such as fake-indexeddb or jsdom); a server runtime in the code (Node built-in, server-only package such as express/mongodb/winston/@aws-sdk, HTTP response sink, Lambda handler export); the IMPORT GRAPH (a module a client-declared file imports runs in the browser, a module that imports a server-proven module runs on a server); the folder convention (`workers/` is no longer one of them: a worker folder is a browser convention as often as a server one); a universal Web API of the browser with no server evidence at all; otherwise unproven, which is never server. Found by the attestation campaign of the platform (2026-09-25): 73 of the 252 high findings of every project were this one classification. (1.1.2: a callee whose root is a name that `Object.prototype` also carries (`build().toString()` tokenizes to the bare callee `toString`; also `constructor`, `valueOf`, `hasOwnProperty`) was looked up in the plain object that holds the imported names, so it resolved to the INHERITED FUNCTION instead of to nothing and the whole check died with "name.includes is not a function". Only a real binding counts now, and the name of a unit is always read as a string. Found on a 1 319-file checkout (2fa-available and session-expiry-rotation, 2026-09-24); the same line was in the 15 scripts that walk the call graph, so all fifteen ship the fix. (1.1.1: the browser asset folders of the server-rendered frameworks (static/, wwwroot/ and Laravel resources/js/) are classified as browser code, like public/ and assets/ already were: browser JavaScript of a Django, Flask or Go application was being analysed as server code (false positive found by the control bench of the audit scripts). (1.1.0: deterministic: the rule runs over the static analysis kit (tokens, function units, calls, imports, routes) with no AI engine; exact decisionRule and languages published; not-applicable with the reason when the checkout gives nothing to evaluate. Per gateway: the raw-card rules of gateway-tokens-only, webhook handlers verified through the call graph, and a client tokenisation OR hosted-checkout signal; crypto rails are exempt from the tokenisation rule.)))

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.