Has anyone worked through the reasoning that if I have a single-page application (SPA) whose HTML and JavaScript are hosted on Server X, sending credit cards to a remote API hosted on Server Y, does Server X fall under the scope of PCI?
Server Y in this scenario is PCI compliant (hosted application certified by the vendor via a 3rd party).
Server X does serve web pages over HTTPS, the SPA accesses Y's API over HTTPS, and we do make all reasonable efforts to keep X secure.
The API never returns card information, just masked "display" version of the card (i.e. "****" + last 4).
I've found one similar question, but the answer is over 10 years old at this point, and I know the PCI specifications do change of time.