Known Issues

Problem

If a payment method's availability rules change (min/max order total, allowed countries) while customer is in checkout, they can encounter a silent failure when placing the order. The quote still has the payment method set, but it's no longer valid.

Impact

• - Order placement fails with generic error
• - Customer loses their cart configuration
• - Payment gateway may have pending authorization

Workaround

// Add validation before order placement
class ValidatePaymentPlugin
{
    public function beforePlace(
        \Magento\Quote\Model\QuoteManagement $subject,
        CartInterface $quote,
        PaymentInterface $payment = null
    ) {
        $method = $quote->getPayment()->getMethod();
        $instance = $this->methodFactory->create($method);

        if (!$instance->isAvailable($quote)) {
            throw new LocalizedException(
                __('Selected payment method is no longer available.')
            );
        }
    }
}

Problem

If a response handler throws an exception after a successful gateway authorization, the exception may be caught and order placement fails, but the authorization remains active on the gateway. Customer is charged later or funds are held.

Impact

• - Orphaned authorizations on payment gateway
• - Customer funds held without order
• - Manual reconciliation required

Workaround

// Implement void command on failure
class SafeResponseHandler implements HandlerInterface
{
    public function handle(array $handlingSubject, array $response)
    {
        try {
            // Normal handler logic
            $this->processResponse($handlingSubject, $response);
        } catch (\Exception $e) {
            // Void the transaction
            $this->voidCommand->execute($handlingSubject);
            throw $e;
        }
    }
}

Problem

Custom payment methods sometimes store full credit card numbers, CVV, or other sensitive data in the payment additional_information field. This data is persisted to the database unencrypted and may be exposed in admin, logs, or exports.

Impact

• - PCI compliance violation
• - Data breach risk
• - Legal liability

Prevention

// NEVER store these in additional_information:
// - Full card number (cc_number)
// - CVV/CVC (cc_cid)
// - Full expiration date

// Instead, store only:
$payment->setAdditionalInformation([
    'cc_type' => 'VI',        // OK
    'cc_last4' => '1111',     // OK
    'transaction_id' => '...', // OK
    'auth_code' => '...',      // OK
]);

// Use Vault for tokenization