Does anyone know if Rails 3.0 passes PCI compliance scans?
3 Answers
Frameworks that are used are not the issue, it the applications that are built on the framework. So essentially PCI is framework - rails in this case - agnostic.
Just make sure you code a secure app using rails and you will be fine.
I suspect that depends deeply on how you write your application on top.
I could write an application that didn't store credit card data encrypted, or was otherwise filled with security holes, and then it wouldn't be PCI-DSS compliant, regardless of the framework underneath.
-
Right, how an application is handling the data definitely influences compliance. I'm concerned about the language / framework specific DSS scan results (for example, PHP 5.2.X is regarded as non-compliant by most scanners).– BrianOct 15, 2010 at 16:55
-
2Yes, but the point is, no matter how secure a framework, if you've got a shite application on top, then it might as well be PHP 5.2.x Oct 15, 2010 at 17:02
-
-
@Brian Oh, sorry.. I generally find that people are disagreeing with me :P Oct 15, 2010 at 19:40
I'm not sure about Rails 3.0 specifically, but the majority of Braintree's payment gateway is using Rails 2.x, and Braintree is a PCI compliant service provider.