Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Does anyone know if Rails 3.0 passes PCI compliance scans?

share|improve this question
add comment

3 Answers

up vote 6 down vote accepted

Frameworks that are used are not the issue, it the applications that are built on the framework. So essentially PCI is framework - rails in this case - agnostic.

Just make sure you code a secure app using rails and you will be fine.

share|improve this answer
add comment

I suspect that depends deeply on how you write your application on top.
I could write an application that didn't store credit card data encrypted, or was otherwise filled with security holes, and then it wouldn't be PCI-DSS compliant, regardless of the framework underneath.

share|improve this answer
    
Right, how an application is handling the data definitely influences compliance. I'm concerned about the language / framework specific DSS scan results (for example, PHP 5.2.X is regarded as non-compliant by most scanners). –  Brian Mansell Oct 15 '10 at 16:55
2  
Yes, but the point is, no matter how secure a framework, if you've got a shite application on top, then it might as well be PHP 5.2.x –  Tom O'Connor Oct 15 '10 at 17:02
    
You're preaching to the choir, I agree with you. –  Brian Mansell Oct 15 '10 at 17:08
    
@Brian Oh, sorry.. I generally find that people are disagreeing with me :P –  Tom O'Connor Oct 15 '10 at 19:40
add comment

I'm not sure about Rails 3.0 specifically, but the majority of Braintree's payment gateway is using Rails 2.x, and Braintree is a PCI compliant service provider.

share|improve this answer
    
I wonder if they're using railslts.com. –  ceejayoz Dec 3 '13 at 22:56
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.