Free bounded evidence check

Build reviewable payment-page change evidence for PCI DSS 11.6.1

Requirement 11.6.1 calls for a mechanism that detects unauthorized changes to payment-page content and security-impacting HTTP headers and alerts personnel. Tessera re-evaluates every 72 hours, hash-chains the observations, and exposes private status for your monitoring system to poll; it does not itself notify personnel. Stale evidence is reported separately from chain integrity. This is supporting evidence, not a compliance determination or a replacement for qualified review. Start with a page you are authorized to inspect:

No account or card details
Raw results are not retained in a result database
Observation stays separate from human judgment
Every blind spot remains visible in the result

Source

Trace an authorized asset

Authorized public payment-page URL (optional if pasting served HTML)

Use a public URL, or deliberately paste served HTML below when a cart or login protects the page.

Compare an authorized script list (optional)

Authorized script domains

Leave blank to inventory scripts without deciding authorization.

Use deliberately captured served HTML (cart or login)

Served payment-page HTML

Paste only source you own or may submit. Remove credentials, card or customer data, session tokens, and other secrets. Raw HTML is not stored in the result database or browser checkout context.

Use only a page or domain you own or are authorized to inspect. Never enter credentials, card data, personal data, or session tokens.

A visible current, not a score

Each observation keeps its source and its limit.

This specimen is synthetic and sends no request. A real check replaces it with observations from the request snapshot.

Representative outputObserved inventory

processor.test/sdk.jssource host · integrity observed
/assets/checkout.jssame origin · integrity not observed
1 inline script blockauthorization not assessed

Free CI integration

Carry the same bounded inventory into GitHub Actions.

The public MIT-licensed Action is published from the operator's personal ntoledo319 GitHub account. Point it at an authorized public URL or deliberate workspace-relative HTML file. It writes bounded findings to the job summary.

- uses: ntoledo319/pci-payment-page-check@v1
  with:
    url: https://yourstore.com/checkout
    allowed-domains: js.stripe.com
    fail-on: high

It does not inspect headers, fetch referenced script bodies, execute JavaScript, determine authorization, or determine PCI DSS compliance.

Downstream, only when delivery is ready

Inspect the artifact. Keep the exact price visible.

Samples are synthetic and contain the same evidence sections as delivery. A checkout link appears only in an eligible fresh result while fulfillment is healthy.

$99 / month

PCI DSS 11.6.1 evidence ledger

A 72-hour cadence, hash-chained history, and private status for your alerting system to poll; Tessera does not notify personnel.

Preview the synthetic 11.6.1 ledger

$299 once

PCI DSS 6.4.3 remediation pack

Finding-by-finding observation, risk, fix, and validation guidance.

Preview the synthetic 6.4.3 pack

Named operatorIndependent software from Toledo Technologies LLC.

Merchant of recordPolar handles payment and receipts.

Delivery protectionEligible paid orders automatically refund if no complete initial delivery arrives within 48 hours; ledger renewal is also stopped.

Questions: qi@toledotechnologies.com. Enforced refund policy.