ENGINEERING NOTE 37 / 50 · CARD
Export card audit data without exposing card secrets
An audit export needs traceable financial references, not full card credentials. Design the export schema separately from the operational database schema.
Published by OPEN RAMBO. The engineering patterns and pseudocode illustrate designs, not a documented product API. Numerical examples are illustrative.
Select fields explicitly
Use an allowlist for transaction reference, masked card reference, amount, currency, state and timestamps. Serializing an entire database document risks leaking fields added later. Apply tenant and owner scope before generating the file.
Protect spreadsheet consumers
Treat merchant names and notes as untrusted text when exporting CSV. Spreadsheet applications may interpret certain leading characters as formulas. Escape or encode according to the export format while preserving the original value in the source system.
Expire access
Use authorized downloads with limited lifetime and record export access. A public permanent URL is a poor default for financial records. Keep file retention and deletion aligned with the organization’s documented requirements.
Illustrative implementation
export_fields = ["transaction_ref", "card_last4", "amount",
"currency", "status", "posted_at"]
# Never serialize the complete card document.Acceptance check
Test a note beginning with a spreadsheet formula character and another user’s export request. Neither should bypass the intended boundary.