My 2 cents... Among other, one of the main benefits of using Stripe is actually freeing users (developers) from the burden of having to get PCI complaint. Onc

My 2 cents... Among other, one of the main benefits of using Stripe is actually freeing users (developers) from the burden of having to get PCI complaint. Once you have a "payment token", there is no need whatsoever to POST ALL the form data back to "your" server (along with the appended token attribute). At this point all you need is the payment token (and the last 4 digits of the cc for having a weak reference (though enough) to the cc currently being used). This would potential mislead a few users out there who have no idea about the security implications of such action. To recap, a good Stripe example shall not include any assumptions about having server being PCI complaint. Also, in regards to this example (and the form example in the Stripe docs), there is no mention about the implications of POSTing the form data safely (and not in plain text as one would assumed from the code) e.g. using SSL. Though, this might be trivial to some of you, examples should make this point clear and leave no assumptions behind.