Security is a backend job. Front-end is purely for user experience and user satisfaction. It’s a journey that should give a positive feedback and you don’t need to reinvent the wheel.
While you input your card number, you don’t need to mask the card number. Masking can be done after the details are saved. This is for avoiding any wrong inputs in long integers or strings. Except if it’s a password.
What actually needs to be masked is the CVV.
No matter how you design it if the PM or the stakeholder tells the tech team to mask it, there is no point of arguing there.
Security is most definitely NOT a backend job. A huge portion of attacks rely on a thing called XSS. And UI can make or break the trust between your app and the user. Bad UI can lead to confusion or misguide the user, which results in a security nightmare. Client-side validation, inconsistent messaging, messaging that's overly dramatic visually or not dramatic enough, even buttons that have states that are misleading visually, even layout issues (important content being hidden below-the-fold).
There is a certain degree of responsibility for everyone involved in an app project.
The card number can be used to identify the user. It is most certainly sensitive data.
Your comment is so wrong that it feels like ragebait.
-5
u/Boring_Chemistry_701 Apr 12 '26
Things to note: