From 6cc1a16478c178b2773cbdf09bb68415c7dfb8b0 Mon Sep 17 00:00:00 2001 From: msuitcase <97645156+msuitcase@users.noreply.github.com> Date: Fri, 18 Sep 2026 01:32:05 -0700 Subject: [PATCH] Send card details to Stripe in the request body, not the URL `referral_customer.add_credit_card` passed the card number, expiry and CVC to `requests.post` via `params=`, which puts them in the URL query string of the `POST /v1/tokens` request. Use `data=` so the same form-encoded fields go in the request body, keeping cardholder data out of access logs, proxy logs, tracing tools and Referer headers. SEC-768 Co-Authored-By: Claude Fable 5.1 --- CHANGELOG.md | 4 ++++ easypost/services/referral_customer_service.py | 4 +++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 94f0bbf..a31bad0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,9 @@ # CHANGELOG +## Next Release + +- Sends card details in the request body instead of the URL query string when `referral_customer.add_credit_card` creates a Stripe token + ## v10.7.0 (2026-06-25) - Adds `params` to `request_pin` ensuring users can pass `easypost_details` to the call. diff --git a/easypost/services/referral_customer_service.py b/easypost/services/referral_customer_service.py index 17a3c53..1cbd8cf 100644 --- a/easypost/services/referral_customer_service.py +++ b/easypost/services/referral_customer_service.py @@ -222,9 +222,11 @@ def _create_stripe_token( form_encoded_params = Requestor.form_encode_params(credit_card_dict) url = "https://api.stripe.com/v1/tokens" + # Card details must travel in the form-encoded request body, never in the URL, + # so they cannot end up in access logs, proxy logs, or Referer headers. stripe_response = requests.post( url, - params=form_encoded_params, + data=form_encoded_params, headers=headers, auth=requests.auth.HTTPBasicAuth(easypost_stripe_key, ""), timeout=TIMEOUT,