See what your checkout actually loads.
PCI Scope Lens is a browser extension for Shopify and card-checkout pages. It flags third-party scripts, iframes, and payment fields so a small team can see what is in scope before filling in a PCI SAQ A questionnaire.
What it does
- Highlights scripts, iframes, and input fields on the current checkout page.
- Marks payment fields and third-party origins that may expand SAQ scope.
- Runs entirely in the tab; no account, no telemetry, no upload.
Install
Firefox: download the .xpi, open about:debugging#/runtime/this-firefox, choose Load Temporary Add-on.
Edge: download the .zip, open edge://extensions, enable Developer mode, choose Load unpacked.
Store listings are pending; the GitHub release is the manual-install channel.
Quick SAQ A self-check
Use this as a conversation starter, not an audit. If you answer “no” to 1–3, the payment page may be outside the simplest SAQ A shape.
- Are card number, expiry, and CVV fields inside a payment-provider iframe or hosted fields?
- Does your server ever receive raw card data, even transiently?
- Is the checkout page served over HTTPS with no mixed-content warnings?
- Do you know which third-party scripts run on the checkout page?
- Can you list every payment provider and integration in the card flow?
- Do you have a current network diagram for the checkout path?
Privacy
No automatic network calls, no storage, no analytics. The extension reads page structure only; it does not read or transmit form values. The only outbound link is the “Download” / “Source” link you click.