Free bounded evidence check

Find scripts on your payment page that still need review

Inventory the script elements present in served HTML and, when you supply your authorized-domain list, highlight observed hosts absent from it. This bounded static check does not inspect HTTP response headers, fetch referenced script bodies, or execute JavaScript, so runtime-injected scripts may be invisible. Only you can decide whether a script is authorized. Requirements 6.4.3 and 11.6.1 apply only where in scope; SAQ A uses a separate eligibility criterion. Confirm scope with your acquirer or QSA. This is evidence for qualified review, not a PCI DSS compliance determination or replacement for a QSA assessment.

No account or card details
Raw results are not retained in a result database
Observation stays separate from human judgment
Every blind spot remains visible in the result

Inspect the matching synthetic deliverable

Source

Trace an authorized asset

Authorized public payment-page URL (optional if pasting served HTML)

Use a public URL, or deliberately paste served HTML below when a cart or login protects the page.

Compare an authorized script list (optional)

Authorized script domains

Leave blank to inventory scripts without deciding authorization.

Use deliberately captured served HTML (cart or login)

Served payment-page HTML

Paste only source you own or may submit. Remove credentials, card or customer data, session tokens, and other secrets. Raw HTML is not stored in the result database or browser checkout context.

Use only a page or domain you own or are authorized to inspect. Never enter credentials, card data, personal data, or session tokens.

A visible current, not a score

Each observation keeps its source and its limit.

This specimen is synthetic and sends no request. A real check replaces it with observations from the request snapshot.

Representative outputObserved inventory

processor.test/sdk.jssource host · integrity observed
/assets/checkout.jssame origin · integrity not observed
1 inline script blockauthorization not assessed

Free CI integration

Carry the same bounded inventory into GitHub Actions.

The public MIT-licensed Action is published from the operator's personal ntoledo319 GitHub account. Point it at an authorized public URL or deliberate workspace-relative HTML file. It writes bounded findings to the job summary.

- uses: ntoledo319/pci-payment-page-check@v1
  with:
    url: https://yourstore.com/checkout
    allowed-domains: js.stripe.com
    fail-on: high

It does not inspect headers, fetch referenced script bodies, execute JavaScript, determine authorization, or determine PCI DSS compliance.

Downstream, only when delivery is ready

Inspect the artifact. Keep the exact price visible.

Samples are synthetic and contain the same evidence sections as delivery. A checkout link appears only in an eligible fresh result while fulfillment is healthy.

$299 once

PCI DSS 6.4.3 remediation pack

Finding-by-finding observation, risk, fix, and validation guidance.

Preview the synthetic 6.4.3 pack

$99 / month

PCI DSS 11.6.1 evidence ledger

A 72-hour cadence, hash-chained history, and private status for your alerting system to poll; Tessera does not notify personnel.

Preview the synthetic 11.6.1 ledger

Named operatorIndependent software from Toledo Technologies LLC.

Merchant of recordPolar handles payment and receipts.

Delivery protectionEligible paid orders automatically refund if no complete initial delivery arrives within 48 hours; ledger renewal is also stopped.

Questions: qi@toledotechnologies.com. Enforced refund policy.