# The Alumni Donation Page — Faculty Case Brief

Part of **W/ Faculty: Payment Security Teaching Studio** · reused from CAMPUS-LAB-03

A fictional university embeds a provider-hosted donation form in a university-managed site. The university controls DNS, page templates, analytics, scripts, developer access, deployment, a provider callback, refund operations, and the evidence retained for review.

## Declared facts

- The provider-hosted form receives the donor's payment account data.
- University-managed code and third-party scripts execute on the surrounding page.
- A public callback records transaction status in a university application.
- Workforce and cloud identities administer the site, callback, logging, and deployment pipeline.
- Refunds begin in a university operations workflow and continue in the provider service.
- The course provides no validation instrument decision, segmentation result, provider responsibility conclusion, or compliance status.

## Productive unknowns

- Which exact provider service and integration mode are in use?
- What data is returned through the callback?
- Which scripts can affect the payment-page experience?
- What current provider assurance and responsibility statements apply?
- Which public terminations, address populations, and application behaviors require testing?
- Which authority will accept the final validation response?

## Material prohibited from the exercise

- Real account data or credentials
- Real provider tenant details or secrets
- Client evidence or assessment findings
- Restricted university architecture
- Unauthorized scanning or penetration testing
- A copied answer presented as an assessment result

## Faculty rule

Do not reveal a model conclusion before students expose the relationship, authority, evidence, uncertainty, and reopening path that would support it.

## Safety and authority boundary

W/ Faculty is independent practitioner education and a public pilot. It is not PCI SSC guidance or official PCI SSC training. It is not an accredited curriculum, a certification program, an assessor qualification, an eligibility decision, a grading mandate, or a compliance result. It is not a PCI DSS assessment and does not substitute for assessor judgment, organizational policy, or compliance-accepting-entity direction. Use only fictional or explicitly sanitized environments. Never enter account data, credentials, provider secrets, client evidence, restricted architecture, student records, or targets the class is not authorized to test.