0

Does anyone know if Rails 3.0 passes PCI compliance scans?

3 Answers 3

6

Frameworks that are used are not the issue, it the applications that are built on the framework. So essentially PCI is framework - rails in this case - agnostic.

Just make sure you code a secure app using rails and you will be fine.

2

I suspect that depends deeply on how you write your application on top.
I could write an application that didn't store credit card data encrypted, or was otherwise filled with security holes, and then it wouldn't be PCI-DSS compliant, regardless of the framework underneath.

4
  • Right, how an application is handling the data definitely influences compliance. I'm concerned about the language / framework specific DSS scan results (for example, PHP 5.2.X is regarded as non-compliant by most scanners).
    – Brian
    Oct 15, 2010 at 16:55
  • 2
    Yes, but the point is, no matter how secure a framework, if you've got a shite application on top, then it might as well be PHP 5.2.x Oct 15, 2010 at 17:02
  • You're preaching to the choir, I agree with you.
    – Brian
    Oct 15, 2010 at 17:08
  • @Brian Oh, sorry.. I generally find that people are disagreeing with me :P Oct 15, 2010 at 19:40
1

I'm not sure about Rails 3.0 specifically, but the majority of Braintree's payment gateway is using Rails 2.x, and Braintree is a PCI compliant service provider.

1

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .