Wow, I just checked their guidance & they absolutely need to reconsider their guidance: "Do I need to be PCI compliant? What do I have to do? Anyone accepting

Wow, I just checked their guidance & they absolutely need to reconsider their guidance: "Do I need to be PCI compliant? What do I have to do? Anyone accepting credit card payments must be PCI compliant—but with Stripe, it's easy: Serve your payment page over SSL, i.e., the page's web address should begin with "https", not "http". Use Stripe.js as the only means by which you accept payment information and transmit it directly to Stripe's servers. By taking these steps, you completely avoid handling sensitive card data, and keep your systems out of PCI scope." So use SSL and Stripe.js and I guess you can use all default passwords, not implement anti-virus and allow XSS, SQLi, command injection, and code injection vectors to run wild on your server? After all, none of those could possibly be used to nuke Stripe.js and replace it with code of choice by an attacker? They are providing highly suspect guidance for sure. https://stripe.com/us/help/faq#pci-compliance https://stripe.com/us/help/faq#pci-compliance