From 066a54b543cfbb4d8bb563dd0c9c997e5dd75925 Mon Sep 17 00:00:00 2001
From: msuitcase <97645156+msuitcase@users.noreply.github.com>
Date: Fri, 18 Sep 2026 01:31:55 -0700
Subject: [PATCH] Send card details to Stripe in the request body, not the URL

`referralCustomer->addCreditCard` passed the card number, expiry and CVC to
Guzzle via the `query` option, which puts them in the URL query string of the
`POST /v1/tokens` request. Use `form_params` so the same form-encoded fields
go in the request body, keeping cardholder data out of access logs, proxy
logs, tracing tools and Referer headers.

SEC-768

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
---
 CHANGELOG.md                                     | 4 ++++
 lib/EasyPost/Service/ReferralCustomerService.php | 4 +++-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8e8aee24..c86d1ef1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,5 +1,9 @@
 # CHANGELOG
 
+## Next Release
+
+- Sends card details in the request body instead of the URL query string when `referralCustomer->addCreditCard` creates a Stripe token
+
 ## v8.8.3 (2026-08-26)
 
 - Preserves caller-provided plain PHP objects in request params so `(object) []` is sent as an empty JSON object (`{}`) instead of being stringified
diff --git a/lib/EasyPost/Service/ReferralCustomerService.php b/lib/EasyPost/Service/ReferralCustomerService.php
index 9ff66f32..a65d8a46 100644
--- a/lib/EasyPost/Service/ReferralCustomerService.php
+++ b/lib/EasyPost/Service/ReferralCustomerService.php
@@ -220,7 +220,9 @@ private function createStripeToken(
 
         $guzzleClient = new Client();
 
-        $requestOptions['query'] = $creditCardDetails;
+        // Card details must travel in the form-encoded request body, never in the URL,
+        // so they cannot end up in access logs, proxy logs, or Referer headers.
+        $requestOptions['form_params'] = $creditCardDetails;
         $requestOptions['headers'] = $headers;
         $requestOptions['http_errors'] = false;