[saikat]

Yeah you are right here that it is still possible for our users to mess things up. We do things to try to keep merchants from accidentally sending card numbers to their server (e.g. the default example form makes this hard to do, and most people simply copy and paste this form). It's an explicit decision we've made, though, to leave control in our users' hands as many people seem to like the flexibility to have their checkout experience stay on their site and be designed by them. But we think about where to draw the lines here a decent amount.