What raceproof touches, and what it doesn't
raceproof is a test tool for your development and test environments. It never needs production access or real card data.
Runs on your machines
The runner, the fakes and the scenarios run locally or in your CI. There is no cloud component and no telemetry: the core talks only to the fake PSP, to your gateway and to your test database.
Test data only
Scenarios use the PSPs' published test cards and test payment methods. raceproof never handles real card data.
Read access to your test database
Scenarios check results with the queries you write in lab.yaml, against your test database. The
database password can come from an environment variable and is masked in every message.
Webhook keys stay out of logs
The fakes read webhook signing keys from environment variables and never print them. Call logs leave out credentials.
Probes refuse live keys
The packs' probes, which measure your own PSP test account, accept test keys only and never print keys or client secrets.
What we don't claim
raceproof is not PCI DSS or EMVCo certified, and software on its own can't be: it stays out of scope because it never sees card data. It finds race bugs; your fix is what prevents them.