Card entry uses Stripe Elements, rendered inside an iframe served by Stripe, so card data never reaches this application's servers, database or logs. Only a payment-method token and customer id are stored.
When Stripe is not configured, the panel renders no card field at all — not a styled placeholder. A look-alike input trains people to type card numbers into a box that is not PCI-scoped, and eventually somebody wires it to a POST. The panel explains why it is absent instead.
Everything monetary behaves the same way. Subscriptions stay pending, pledges stay pledged, tips stay pending, and a paid rental does not unlock playback — because nothing was actually paid.