@molly0xfff How does that even work? Isn't the guy worried that some day he might hit a lawyer who will take him up on his offer of "penalty of perjury"?

Hot take: docker (compose) should have defaulted to `read_only: true` unless overridden.

The number of official project images that try to modify their own container on startup (or put log files there!) is maddening.

@thisismissem The PCI rules changed, starting April this year. It's all very bonkers. Now, even if you embed (iframe) an existing payment form, or even just *link* to it, you land in the category that needs an external scan by an authorized scanning vendor ($$$).
The only option that's exempt is if you don't even link/forward to the payment form, which presumably means that the link is in an email.

Our PSP looked at us and said "yeah, no, you're too small, we'll mark you as autocompliant".