Payment integration detected but payment API not restricted in Permissions-Policy

Permissions-Policy is a browser header that controls which browser features, like the camera, microphone, or the Payment Request API, a page and any third-party scripts on it are allowed to use. This check looks for whether sites with a payment integration have restricted the Payment Request API specifically. On this site, a payment integration is present, but Permissions-Policy doesn't restrict it, meaning third-party scripts on the page could theoretically trigger payment flows. Without a restriction like payment=(), any third-party script running on the page, whether legitimate or a compromised or malicious one, can technically invoke the browser's built-in Payment Request API. This is a defence-in-depth measure rather than a currently active exploit, but it removes a layer of protection specifically around the part of the site handling money. Your developer should add 'payment=()' to the site's Permissions-Policy header if the Payment Request API isn't actually used, or 'payment=(self)' if it is, which still blocks third-party scripts from using it while allowing the site's own code to. This is a small header configuration change, around 10 minutes.