4 ms·

Except this article says it is not served over SSL. There's even a huge graphic with an arrow pointing it out. https://cdn-images-1.medium.com/max/1600/1*dLlQG

• jessedhillon 11y ago
  That could just be the last four digits. When you create a token with Stripe, you do still get those back. Conceivably, they're showing 12 asterisks and the naked last four, while retaining the token Homejoy used with you so they can recharge -- although in order to do that, they would need Homejoy's Stripe API secret.
  • shkkmo 11y ago
    The last four digits are still plenty sensitive enough to make serving them over http blatantly irresponsible.
    • chris_wot 11y ago
      It's not just that - it allows you to update your credit card over unencrypted http.
• ceejayoz 11y ago
  Yes. That's a problem, certainly. I'm just pointing out that Stripe's "are you PCI compliant" process is pretty low-key.