Card data and developer credentials both turned up exposed this week.
Hacker News reports a payment-skimming campaign aimed at restaurant delivery ordering. The Hacker News reports the other half: passwords and API keys that developers typed into commands they approved in Claude Code are sitting readable in public GitHub repositories, after the user chose "Yes, and don't ask again."
Both land on one question for anyone taking card payments: what touches a credential on its way through your system, and who checked it last? That is the review I run on checkout flows. Card entry isolated so your own page never handles the number, secrets kept out of anything that can be committed. Days of work, not months.
Send me your checkout flow and you get cost and timeline back within a day.