Skip to content
PandaPayLens

Security and privacy

Treat every payment log as sensitive. PandaPayLens is designed so that your data never needs to leave your machine.

What happens to your data

  • Parsing, analysis and exports run in your browser, in a Web Worker. There is no server-side analysis endpoint.
  • The page's Content Security Policy sets connect-src 'self', so the browser blocks requests to any other origin. The site makes no requests that contain your input.
  • Imported data is not written to cookies, localStorage, sessionStorage or IndexedDB. Reloading the page clears it. Only your theme choice is stored.
  • No analytics, session replay, or third-party scripts are loaded.
  • Exports are generated locally and saved through your browser's download mechanism.

Sensitive fields

Card numbers, security codes, expiry data, secrets and API keys, tokens and signatures, names, emails, phone numbers, addresses, IPs and bank details are hidden in the data inspector and never exported. Normalization copies only allowlisted fields, and free text is scanned for card numbers (Luhn-checked), keys, emails and IBANs as a second layer.

Redaction is best effort. Pattern matching cannot guarantee that a document is anonymized. Avoid pasting production data that contains full card numbers or security codes, and review exports before sharing them.

Untrusted input

  • JSON is parsed strictly, with limits on size, nesting depth, record count and string length. Analysis is stopped if it takes too long.
  • Prototype-pollution keys are removed before analysis.
  • Imported values are always rendered as text, never as HTML. Markdown exports escape all imported values.
  • URLs inside payloads are never fetched. Documentation links point only to Stripe and Adyen documentation.

Self-hosting

The analyzer is a static, database-free Next.js application. Self-hosted instances run independently and have no connection to the official site. Keep the security headers from proxy.ts and next.config.ts when deploying.

What we don't claim

PandaPayLens is not PCI DSS certified and has not had an independent penetration test. Security statements on this page describe controls that are implemented and covered by automated tests in the repository.

Reporting a vulnerability

Please report vulnerabilities privately through GitHub's private vulnerability reporting on the repository's Security tab. See SECURITY.md for supported versions and the disclosure process. Do not include real payment data in reports.