doordash is regularly audited for PCI, they almost certainly store raw CC#s and follow modern tokenization standards. The best the agent would see is the name you stored for the card if you have multiple cards it can pick from in the account.

You can pull the PCI compliance documentation from their trust center if you are a partner https://trust.doordash.com/

For addresses, it's a almost certain the agent would see those since those are visible in the UI when ordering and required for selecting a destination for the order

It's better they don't because considering how Claude reacts when you give it a meaningless SSH login password for a local box, the moment it learns your CC# and CVV2 it will probably call your bank and cancel the card instead of ordering any food.

> AI, I asked you to check the docs for the latest version of the API, yet you didn't. Why?

> You are completely right! That was my miss, I have no excuse. I've now looked at the docs and implemented it.

Now imagine how triggered you'd be when the AI decides to get you a vegan burger because the chicken wrap is on the second page and it know you're a health conscious person.