Description

ReferralCustomerService._create_stripe_token passes card[number], card[exp_month], card[exp_year] and card[cvc] to requests.post through params=, which places them in the URL query string of the POST https://api.stripe.com/v1/tokens request. Query strings are routinely captured by access logs, outbound proxies, APM/tracing tools and Referer headers, so cardholder data could be retained outside the payment path (PCI DSS requirement 3 / 4).

This change switches to data=, so requests sends the same flattened card[...] fields as an application/x-www-form-urlencoded body, which is what Stripe expects on this endpoint (and what easypost-ruby, easypost-go and easypost-csharp already do). The existing Content-type header already declares that encoding.

Also adds a Next Release CHANGELOG entry.

Tracking: SEC-768 (internal).

Testing

• python -m py_compile passes locally; the change is a one-keyword swap.
• test_referral_customer_add_credit_card is currently @pytest.mark.skipped ("flow is deprecated, cannot easily be tested due to Stripe changes"), so no cassette needs re-recording for this PR to pass. test_referral_add_credit_card_error mocks _create_stripe_token and is unaffected. If that test is ever re-enabled, its match_on list can drop "query" since the request no longer has one.

Pull Request Type

Please select the option(s) that are relevant to this PR.

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Improvement (fixing a typo, updating readme, renaming a variable name, etc)

🤖 Generated with Claude Code