It goes something like this:

(Client): I want to add a shopping cart to my site. I heard that xyz cart is free, can you add that for me?

(Developer): Sure! That looks easy.

(Months and a couple thousand dollars later): Okay, I think it finally works, and is all hooked up, ready to go. I put an SSL certificate on your $15/month GoDaddy account and so now you're all safe and secure.

(Client): Great! I'll just check all the boxes on this PCI questionnaire and we're in business!

A few orders come in here and there, and all seems fine. At first.

E-CommerceDrupalDrupal CommerceDrupal PlanetSecurity