{"action":"opened","issue":{"url":"https://api.github.com/repos/vcobar/weather-status-manager/issues/4","repository_url":"https://api.github.com/repos/vcobar/weather-status-manager","labels_url":"https://api.github.com/repos/vcobar/weather-status-manager/issues/4/labels{/name}","comments_url":"https://api.github.com/repos/vcobar/weather-status-manager/issues/4/comments","events_url":"https://api.github.com/repos/vcobar/weather-status-manager/issues/4/events","html_url":"https://github.com/vcobar/weather-status-manager/issues/4","id":194688608,"number":4,"title":"CC Proposal","user":{"login":"vcobar","id":879975,"avatar_url":"https://avatars.githubusercontent.com/u/879975?v=3","gravatar_id":"","url":"https://api.github.com/users/vcobar","html_url":"https://github.com/vcobar","followers_url":"https://api.github.com/users/vcobar/followers","following_url":"https://api.github.com/users/vcobar/following{/other_user}","gists_url":"https://api.github.com/users/vcobar/gists{/gist_id}","starred_url":"https://api.github.com/users/vcobar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/vcobar/subscriptions","organizations_url":"https://api.github.com/users/vcobar/orgs","repos_url":"https://api.github.com/users/vcobar/repos","events_url":"https://api.github.com/users/vcobar/events{/privacy}","received_events_url":"https://api.github.com/users/vcobar/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2016-12-09T20:24:26Z","updated_at":"2016-12-09T20:24:26Z","closed_at":null,"body":"@rscislow I just learned that we store CC information, and is very concerning, especially seeing what is required to meet the PCI DSS Standards and possible consequences.  In my previous company there was a full team dedicated to keep us compliant, and I know the amount of money is not in the millions?(maybe it is?), I would strongly consider we become compliant.\r\n\r\n### Why is being compliance important \r\n\r\n![selection_005](https://cloud.githubusercontent.com/assets/879975/21032576/316e4e62-bd5f-11e6-8e07-99bad197e212.png)\r\n[resource](https://www.pcicomplianceguide.org/pci-faqs-2/#15)\r\n\r\n### Requirements to be compliant\r\n\r\n<br>\r\n\r\n![selection_004](https://cloud.githubusercontent.com/assets/879975/21032475/78b76bb0-bd5e-11e6-8439-3d6f41aaa395.png)\r\n\r\n### Solutions to be compliant\r\n\r\n- Option 1: Make our system compliant, see the 12 steps above (I am not a security expert myself)\r\n- Option 2: Using Payment Vault Services\r\n  - https://developer.paypal.com/docs/integration/direct/rest-vault-overview/\r\n  - https://www.braintreepayments.com/braintree-pricing\r\n  - https://www.spreedly.com/pricing\r\n\r\n### Proposed Solution:\r\n  Use paypal's vault api.  IT'S FREE AFAIK\r\n\r\n  #### Requirements\r\n\r\n  - [ ] Signup for [paypal business account](https://www.paypal.com/us/webapps/mpp/account-selection)\r\n  - [ ] [Create Rest API App](https://developer.paypal.com/developer/applications)\r\n  - [ ] Implement Code [(SDK and Sample Code HERE)](https://github.com/paypal/PayPal-Ruby-SDK)\r\n  - [ ] Current booking mechanics, will the API accept 'xxxxxxxxx2222' as the credit card number?  \r\n\r\n  ### Local Sample Save CC Info\r\n  Request:\r\n  ```\r\n    @credit_card = CreditCard.new({\r\n       # ###CreditCard\r\n       # A resource representing a credit card that can be\r\n       # used to fund a payment.\r\n       :type => \"visa\",\r\n       :number => \"4222222222222\",\r\n       :expire_month => \"11\",\r\n       :expire_year => \"2018\",\r\n       :cvv2 => \"874\",\r\n       :first_name => \"Vic\",\r\n       :last_name => \"TestClient\",\r\n\r\n        # ###Address\r\n        # Base Address object used as shipping or billing\r\n        # address in a payment. [Optional]\r\n       :billing_address => {\r\n         :line1 => \"52 N Main ST\",\r\n         :city => \"Johnstown\",\r\n         :state => \"OH\",\r\n         :postal_code => \"43210\",\r\n         :country_code => \"US\" }})\r\n\r\n    # Make API call & get response status\r\n    # ###Save\r\n    # Creates the credit card as a resource\r\n    # in the PayPal vault.\r\n    @credit_card.create\r\n  ```\r\n\r\n  Response\r\n  ```\r\n{\r\n\t\"id\": \"CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\"state\": \"ok\",\r\n\t\"type\": \"visa\",\r\n\t\"number\": \"xxxxxxxxx2222\",\r\n\t\"expire_month\": \"11\",\r\n\t\"expire_year\": \"2018\",\r\n\t\"first_name\": \"Vic\",\r\n\t\"last_name\": \"TestClient\",\r\n\t\"billing_address\": {\r\n\t\t\"line1\": \"52 N Main ST\",\r\n\t\t\"city\": \"Johnstown\",\r\n\t\t\"state\": \"OH\",\r\n\t\t\"postal_code\": \"43210\",\r\n\t\t\"country_code\": \"US\"\r\n\t},\r\n\t\"valid_until\": \"2019-12-09T00:00:00Z\",\r\n\t\"create_time\": \"2016-12-09T19:45:02Z\",\r\n\t\"update_time\": \"2016-12-09T19:45:02Z\",\r\n\t\"links\": [\r\n\t\t{\r\n\t\t\t\"href\": \"https://api.sandbox.paypal.com/v1/vault/credit-cards/CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\t\t\"rel\": \"self\",\r\n\t\t\t\"method\": \"GET\"\r\n\t\t},\r\n\t\t{\r\n\t\t\t\"href\": \"https://api.sandbox.paypal.com/v1/vault/credit-cards/CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\t\t\"rel\": \"delete\",\r\n\t\t\t\"method\": \"DELETE\"\r\n\t\t},\r\n\t\t{\r\n\t\t\t\"href\": \"https://api.sandbox.paypal.com/v1/vault/credit-cards/CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\t\t\"rel\": \"patch\",\r\n\t\t\t\"method\": \"PATCH\"\r\n\t\t}\r\n\t]\r\n}\r\n  ```\r\n\r\n\r\n  ### Local Sample Get CC Info\r\n  Request:\r\n  ```\r\n\r\n    # #GetCreditCard Sample\r\n    # This sample code demonstrates how you\r\n    # retrieve a previously saved\r\n    # Credit Card using the 'vault' API.\r\n    # API used: GET /v1/vault/credit-card/{id}\r\n    # Retrieve the CreditCard  by calling the\r\n    # static `find` method on the CreditCard class,\r\n    # and pass CreditCard ID\r\n    @credit_card = CreditCard.find(\"CARD-3L874134RP884521YLBFQTPQ\")\r\n  ```\r\n\r\n  Response\r\n  ```\r\n{\r\n\t\"id\": \"CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\"state\": \"ok\",\r\n\t\"type\": \"visa\",\r\n\t\"number\": \"xxxxxxxxx2222\",\r\n\t\"expire_month\": \"11\",\r\n\t\"expire_year\": \"2018\",\r\n\t\"first_name\": \"Vic\",\r\n\t\"last_name\": \"TestClient\",\r\n\t\"billing_address\": {\r\n\t\t\"line1\": \"52 N Main ST\",\r\n\t\t\"city\": \"Johnstown\",\r\n\t\t\"state\": \"OH\",\r\n\t\t\"postal_code\": \"43210\",\r\n\t\t\"country_code\": \"US\"\r\n\t},\r\n\t\"valid_until\": \"2019-12-09T00:00:00Z\",\r\n\t\"create_time\": \"2016-12-09T19:45:02Z\",\r\n\t\"update_time\": \"2016-12-09T19:45:02Z\",\r\n\t\"links\": [\r\n\t\t{\r\n\t\t\t\"href\": \"https://api.sandbox.paypal.com/v1/vault/credit-cards/CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\t\t\"rel\": \"self\",\r\n\t\t\t\"method\": \"GET\"\r\n\t\t},\r\n\t\t{\r\n\t\t\t\"href\": \"https://api.sandbox.paypal.com/v1/vault/credit-cards/CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\t\t\"rel\": \"delete\",\r\n\t\t\t\"method\": \"DELETE\"\r\n\t\t},\r\n\t\t{\r\n\t\t\t\"href\": \"https://api.sandbox.paypal.com/v1/vault/credit-cards/CARD-3L874134RP884521YLBFQTPQ\",\r\n\t\t\t\"rel\": \"patch\",\r\n\t\t\t\"method\": \"PATCH\"\r\n\t\t}\r\n\t]\r\n}\r\n  ```\r\n\r\n### PCI Compliance resources\r\n  - https://www.pcicomplianceguide.org/pci-faqs-2/#1\r\n  - https://www.chargebee.com/blog/vaulting-credit-card-externally-super-important-recurring-payments/"}}
{"actor":{"display_login":"vcobar"}}