getreadystack/payment-page-script-audit repository overview

⁠PCI DSS 6.4.3 Payment Page Script Inventory Auditor

Lists every script on your checkout page that has no integrity hash, no authorisation and no written justification - the three things PCI DSS 6.4.3 has required since 31 March 2025.

⁠Run

docker run --rm -v "$PWD":/work readystack/payment-page-script-audit /work/file

The same 22 rules as the VS Code extension, in a container. Mount a folder on /work.

⁠Free

• Checks the checkout page or template you have open - or only the lines you select - against all 22 PCI DSS 6.4.3 and 11.6.1 rules and lists every finding with its line number.
• --rules lists every rule

⁠With a licence ($29 once)

• Scans every template in the repository, writes the script inventory out as CSV, JSON or HTML, and emits machine-readable output so the check can run in CI on the seven-day cycle 11.6.1 asks for.

docker run --rm -e READYSTACK_LICENSE=<key> -v "$PWD":/work readystack/payment-page-script-audit --dir /work --ci

Hosted payment-page script-monitoring services run $99-$999 per month for small businesses.

Set READYSTACK_LICENSE=<key> or run --license <key> once.

Get a licence⁠