Does anyone know if Rails 3.0 passes PCI compliance scans?


Frameworks that are used are not the issue, it the applications that are built on the framework. So essentially PCI is framework - rails in this case - agnostic.

Just make sure you code a secure app using rails and you will be fine.


I suspect that depends deeply on how you write your application on top.
I could write an application that didn't store credit card data encrypted, or was otherwise filled with security holes, and then it wouldn't be PCI-DSS compliant, regardless of the framework underneath.

  • Right, how an application is handling the data definitely influences compliance. I'm concerned about the language / framework specific DSS scan results (for example, PHP 5.2.X is regarded as non-compliant by most scanners). – Brian Oct 15 '10 at 16:55
  • 2
    Yes, but the point is, no matter how secure a framework, if you've got a shite application on top, then it might as well be PHP 5.2.x – Tom O'Connor Oct 15 '10 at 17:02
  • You're preaching to the choir, I agree with you. – Brian Oct 15 '10 at 17:08
  • @Brian Oh, sorry.. I generally find that people are disagreeing with me :P – Tom O'Connor Oct 15 '10 at 19:40

I'm not sure about Rails 3.0 specifically, but the majority of Braintree's payment gateway is using Rails 2.x, and Braintree is a PCI compliant service provider.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.