Security

Pages send a content security policy that allows scripts only from this site. Card fields are not embedded here. The TagadaPay secret, if one is configured, stays in the host's environment and is not in the page or in git.

A checkout request can only ask for a named package. It cannot name a price. Payment notices are accepted only when the signature matches and the timestamp is within five minutes.

If you find a problem, email developer@thehoneypot.com.au. Please describe what you saw. Do not include a card number or a password.