At some some point accept js implementation was using js to generate the credit card form inputs. Then in one the later code improvement it got turn to use drupal FAPI. This introduced a minor PCI compliance problem since a user with js disable can still submit their form and thus skip the js code part which make sure that the credit card number input is wiped before form submission.
Use a markup placeholder as commerce braintree does then generate form inputs with js.
Needs review
1.0
Code
Not all content is available!
It's likely this issue predates Contrib.social: some issue and comment data are missing.
This may now be a duplicate of ✨ Expand Accept.js to include Accept.js UI Needs review since that is a pure JS implementation meant to minimize compliance requirements but I'm unsure what the PCI DSS implications of the current codebase for acceptjs is.