I'll explain the program I have developed and I'd like to know your suggestions/thoughts on the security of it ..
It is an ordering script which will handle cc data and process cards through a merchant gateway - because it will handle recurring transactions these cc numbers must be encrypted and stored in the database. Now what I think is best is that the data is encrypted with an encryption string defined in the script and then the admin approves the new customer and assigns it a new encryption key and that will be used when running it in future (and will not be stored on the server).
Now, my concern is with the initial encryption as the encryption method will need to be in the script so it can be decrypted - should I somehow hide the source of the encryption/decryption file? I did a search here and discovered Bleach, but it appears that the source can be revived from that. It needs to be portable also..
Would love people's opinions on this, I apreciate any feedback.
Thanks