[next-devin]

Released: 3DS Mode shipped in platform release 2026.10.26.1 (oscar-prime #5864 is on master). Labels checked against that release: card 3DS, field 3DS Mode, options Off / Smart / Always On with matching descriptions, Enable Optimized 3D Secure Transactions, Smart countries US/CA/AU/NZ. The dashboard shows a Recommended badge on Smart; these docs leave that out on purpose.

Risk screening corrected (c6cecfd): the risk table now follows the released take_minfraud logic and the behavior table in https://github.com/NextCommerceCo/oscar-prime/issues/5821#issuecomment-6414688040. With Optimized 3DS2 off, orders that will go through 3DS anyway (every Always On order, Smart orders outside US/CA/AU/NZ) are not scored, so they are never declined, even above 90. The Risk Screening page says the same. Ready to merge.

What changes for merchants

• The gateway 3DS card replaces the Enable 3D Secure Transactions checkbox with a 3DS Mode dropdown: Off, Smart, Always On. Existing gateways map to Always On or Off; none switch to Smart on their own.
• New Smart Mode section: skips 3DS for US, Canada, Australia and New Zealand billing addresses unless the order scores above the store's risk tolerance, and authenticates everything else.
• New How 3DS Modes Use Risk Screening table. On a 3DS gateway, an order above risk tolerance now goes through 3DS with the challenge shown instead of being declined; above 90 is always declined.
• Optimized 3DS2 rewritten as a checkbox under Smart and Always On, with when to keep it now that Smart covers low-friction markets. Higher risk orders never skip the challenge.
• Risk Screening page notes the 3DS behavior.
• Gateway pages updated to the new label. Stripe Payment Intents corrected: it uses Stripe's own 3DS, with no Merchant Profile and no Optimized 3DS2.

Check before merge

• Labels match production UI after deploy.
• "Recommended" is not claimed in docs copy on purpose.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	nextcommerce-docs	c0532a2	Commit Preview URL Branch Preview URL	Oct 28 2026, 09:29 AM

[kilo-code-bot]

Code Review Summary

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	44	The "Any other country" row still reads only "Charged with 3DS, unless Optimized 3DS2 skips the challenge", with no pointer to the risk rules that apply when Optimized 3DS2 is on: those orders are risk screened, so one above the risk tolerance shows the challenge and one scored above 90 is declined rather than being charged with 3DS. Carried forward from the previous round and declined by the author there; an active inline thread already covers this line, so no duplicate comment was posted.

Files Reviewed (2 files)

• content/docs/features/payments/3ds2-payments.mdx - 1 issue
• content/docs/features/payments/risk-screening.mdx - 0 issues

Fix these issues in Kilo Cloud

Previous Review Summaries (7 snapshots, latest commit 9667de8)

Current summary above is authoritative. Previous snapshots are kept for context only.

Previous review (commit 9667de8)

Status: 2 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	43	The new clause joins the two rules with "and" ("... must complete the challenge, and orders above 90 are declined") instead of stating the above-90 case as an exception, so the cell literally says a >90 order is both charged with 3DS and challenged and declined - and at a Risk Tolerance of 90 (the slider maximum) both clauses cover exactly the same orders. Line 57 states the same rule unambiguously as an exception ("unless they score above 90, which are declined"); "orders above 90" also drops the score qualifier used on line 57 and on the Risk Screening page.

SUGGESTION

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	44	Carried forward, declined by the author in the previous round: the "Any other country" row still reads only "Charged with 3DS, unless Optimized 3DS2 skips the challenge", with no pointer to the risk rules that apply when Optimized 3DS2 is on - those orders are risk screened, so one scored above 90 is declined rather than charged with 3DS. An active inline thread already covers this line, so no duplicate comment was posted.

Files Reviewed (2 files)

• content/docs/features/payments/3ds2-payments.mdx - 2 issues
• content/docs/features/payments/risk-screening.mdx - 0 issues

Fix these issues in Kilo Cloud

Previous review (commit 0e3379c)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	43	The Smart Mode row for the four countries still says above-tolerance orders "are charged with 3DS and must complete the challenge" with no above 90 exception, so it contradicts the corrected rule on line 57. With Risk Tolerance at the slider maximum of 90, every above-tolerance order is above 90 and is declined.
content/docs/features/payments/risk-screening.mdx	7	"higher risk checkouts are charged with 3DS instead of being declined" is unconditional, but the linked 3DS2 rule declines checkouts scored above 90, and this page's own Risk Tolerance slider maxes out at 90 - so at 90 every above-tolerance checkout is declined, the opposite of what the sentence promises.

SUGGESTION

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	44	The new Optimized 3DS2 qualifier covers the normal-risk case but not the decline path it opens up: with Optimized 3DS2 on these orders are risk screened, so an order scored above 90 is declined rather than "charged with 3DS".

Files Reviewed (2 files)

• content/docs/features/payments/3ds2-payments.mdx - 2 issues
• content/docs/features/payments/risk-screening.mdx - 1 issue

Incremental review of 0e3379c at b236478 (commit "3DS2 docs: correct three statements after the trim"), which changed three lines across the 3DS2 and Risk Screening pages.

Resolved by this commit and verified against current HEAD:

• 3ds2-payments.mdx:44 now qualifies the non-four-country row with Optimized 3DS2, and the new #optimized-3ds2 anchor resolves - the repo's own slugger (scripts/validate-links.mjs) maps the ### Optimized 3DS2 heading to optimized-3ds2, and relative fragment links are already used in content/docs/apps/campaigns-app/index.mdx:33.
• 3ds2-payments.mdx:57 now reads "unless they score above 90, which are declined", so the two rules no longer collide at a Risk Tolerance of 90.
• risk-screening.mdx:7 now names the real control (3DS Mode set to Smart or Always On) and links to #3ds-mode and #3ds-and-risk-screening, both of which resolve against the ### 3DS Mode and ### 3DS and Risk Screening headings.
• The three findings from the previous round that were carried forward (migration note, Smart mode scope caveats, the Payments > Risk note) remain declined by the author; the first two were answered with a stated editorial decision and are not re-raised. The Optimized 3DS2 is on wording on 3ds2-payments.mdx:58 already has an active inline comment and was not duplicated.

Carried forward from the earlier rounds: no previously reported finding is still outstanding - the PayPal Commerce Platform 3DS Mode gap was closed in 7eadfa0/da48390, and the start-here checklist now uses the same 3DS Mode name as the Payments Guide.

Assumptions: Custom instructions referenced AGENTS.md, CLAUDE.md, .claude/rules and .agents/rules. AGENTS.md was read (repository conventions and publishing process only, no payments domain rules); CLAUDE.md and .agents/rules do not exist and .claude/ contains only a changelog skill with no domain rules. The released platform behaviour behind 3DS Mode (oscar-prime 2026.10.26.1, take_minfraud) cannot be verified from this repository, so findings are limited to internal consistency of the documentation; the release notes and the take_minfraud behaviour quoted in the PR description were taken as the source of truth. Review is advisory only.

Fix these issues in Kilo Cloud

Previous review (commit b236478)

Status: 7 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	3
SUGGESTION	4

Issue Details (click to expand)

WARNING

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	44	"Charged with 3DS" for orders outside the four countries is no longer qualified by Optimized 3DS2 — the qualifier and its cross-reference were deleted — so the row contradicts the Optimized 3DS2 section (a challenged order is charged without 3DS) and hides the risk screening behaviour that applies once Optimized 3DS2 is on.
content/docs/features/payments/3ds2-payments.mdx	57	"orders above your risk tolerance are charged with 3DS" and "Orders scored above 90 are declined" conflict when Risk Tolerance is 90 (the slider maximum): the same order is both challenged and declined. The note that previously covered exactly this case was deleted by this rewrite.
content/docs/features/payments/risk-screening.mdx	7	"On gateways with 3DS turned on" uses a term that is not a control in the product (the control is 3DS Mode: Off / Smart / Always On), no longer links to the 3DS Mode section, and no longer names the modes the rule applies to.

SUGGESTION

File	Line	Issue
content/docs/features/payments/risk-screening.mdx	7	The note that checkouts sent through 3DS by risk screening are not listed under Payments > Risk was removed, so merchants looking for those attempts in the list the next section points them to will not find them.
content/docs/features/payments/3ds2-payments.mdx	58	"unless Optimized 3DS2 is on" does not cover gateways where the option does not exist (Stripe Payment Intents); the earlier "off or not available on the gateway" wording was dropped.
content/docs/features/payments/3ds2-payments.mdx	35	The migration note explaining that existing gateways map from the removed Enable 3D Secure Transactions checkbox to Always On or Off was deleted, leaving merchants upgrading without the mapping.
content/docs/features/payments/3ds2-payments.mdx	39	The Smart mode scope caveats were removed: that Smart mode applies to the initial checkout charge (not upsells, subscription renewals, wallet payments or dashboard orders), and the shipping address fallback used when there is no billing address.

Files Reviewed (4 files)

• content/docs/features/payments/3ds2-payments.mdx - 5 issues
• content/docs/features/payments/risk-screening.mdx - 2 issues
• content/docs/features/payments/gateways/next-payments.mdx - 0 issues
• content/docs/features/payments/gateways/stripe-payment-intents.mdx - 0 issues

Incremental review of da48390 at b236478 (commit "3DS2 docs: trim to a task-focused guide"), which rewrote the 3DS2 page into a shorter guide and trimmed the Risk Screening page. All seven findings above are on lines changed by that commit.

Verified as consistent in the incremental diff:

• Anchor integrity: the renamed section resolves correctly — risk-screening.mdx:7 links to /docs/features/payments/3ds2-payments#3ds-and-risk-screening, matching the ### 3DS and Risk Screening heading under fumadocs slugging. A repository-wide search found no remaining reference to the removed #how-3ds-modes-use-risk-screening anchor, and #3ds-mode / #3ds2-merchant-profiles still resolve.
• The deleted 3DS2 gateway list and the payments overview table remain consistent: PayPal Commerce Platform is absent from the list and reads No in the overview, and the 9 gateways marked Yes are the same set in both.
• The rewrite removed duplicated prose (the repeated "You will be prompted to enter…" sentence) and merged the mode table, Smart Mode table and risk table into a single Smart Mode table plus a "3DS and Risk Screening" bullet list; the Off / Smart / Always On outcomes agree with the gateway pages, which all instruct merchants to set 3DS Mode to Smart or **Always On`.
• next-payments.mdx and stripe-payment-intents.mdx were trimmed to point at the shared 3DS2 page rather than restate Smart mode. The still-open thread at stripe-payment-intents.mdx:62 (whether Smart's country-based skip applies on Stripe Payment Intents) was answered by the author in 733183e and is now covered by the generic Smart Mode section; no duplicate comment was posted for it.

Carried forward from earlier rounds: no previous finding is still outstanding. The PayPal Commerce Platform migration gap was resolved in 7eadfa0/da48390 (page now states 3DS2 is not supported, the 3DS card is shown and Off is the only accepted 3DS Mode), and the start-here checklist now uses the same 3DS Mode control name as the Payments Guide.

Assumptions: Custom instructions referenced AGENTS.md, CLAUDE.md, .claude/rules and .agents/rules. AGENTS.md was read (it covers repository conventions and publishing process only, with no payments domain rules); CLAUDE.md and .agents/rules do not exist, and .claude/ contains only a skills/changelog directory with no domain rules, so no domain-specific rules were applied. The released platform behaviour behind the 3DS Mode feature (oscar-prime 2026.10.26.1, take_minfraud) cannot be verified from this repository, so findings are limited to internal consistency of the documentation; the trade-off between the trimmed caveats and the rewritten behaviour was not verified against the deployed dashboard UI. Review is advisory only.

Fix these issues in Kilo Cloud

Previous review (commit da48390)

Status: No Issues Found | Recommendation: Merge

Files Reviewed (2 files)

• content/docs/features/payments/gateways/paypal-commerce-platform.mdx
• content/docs/start-here/get-started/add-payment-providers.mdx

Incremental review of 7eadfa0 at da48390: the three previously reported findings are resolved. The PayPal Commerce Platform page now states that the gateway displays a 3DS card and that Off is the only accepted 3DS Mode, and the start-here setup checklist now uses the same 3DS Mode control name as the Payments Guide. A targeted search found no remaining stale "Enable 3DS support" or equivalent setup wording.

The incremental diff changed two documentation lines, both within the Tiny review tier, and no sub-agents were needed. The previously resolved findings on 3ds2-payments.mdx were not re-analyzed.

Assumptions: .claude/rules does not exist in this repository, so no domain-specific rules were applied. Platform UI behavior was not independently verified from this repository; findings are limited to the changed documentation and its internal consistency.

Previous review (commit 7eadfa0)

Status: 3 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	1
SUGGESTION	2

Issue Details (click to expand)

WARNING

File	Line	Issue
content/docs/features/payments/gateways/paypal-commerce-platform.mdx	34	The new text tells merchants to "Leave 3DS Mode on the gateway's 3DS card set to Off", but the same PR's premise is that this gateway supports no 3DS path at all and the form rejects Smart/Always On with "This gateway does not support 3DS transactions." If there is no 3DS card or 3DS Mode control on the gateway, this sends merchants hunting for a setting that is not there. Every other non-3DS2 gateway page (Authorize.net:29, Paysafe:36) states "not supported on X" and adds no control instructions. Needs confirmation against the deployed gateway form.

SUGGESTION

File	Line	Issue
content/docs/features/payments/gateways/paypal-commerce-platform.mdx	34	"Smart and Always On cannot be saved on this gateway" does not follow from "3DS2 is not supported": a gateway with no 3DS support is not one where two of three modes fail to save, it has no 3DS modes at all. The blocker is the gateway's 3DS support, not the mode values — Always On is defined as "Every transaction is attempted with 3DS authentication", which reads as a general 3DS request rather than a 3DS2-specific capability, so a reader will reasonably ask why it is unavailable.
content/docs/features/payments/index.mdx	54	The parallel "Adding a Payment Gateway" checklist on the start-here page (content/docs/start-here/get-started/add-payment-providers.mdx:24) still reads "Enable [3DS] support (optional), and assign a 3DS Merchant Profile...", so the same setup step in the same flow is now documented with two different control names across two pages that merchants move between. The start-here page should be updated in this PR.

Files Reviewed (3 files)

• content/docs/features/payments/3ds2-payments.mdx - 0 issues
• content/docs/features/payments/gateways/paypal-commerce-platform.mdx - 2 issues
• content/docs/features/payments/index.mdx - 1 issue

Incremental review of 7eadfa0 (previous review at d18f35d): this commit resolves the PayPal Commerce Platform finding that was carried forward from the prior review. PayPal is removed from the 3DS2-capable gateway list on 3ds2-payments.mdx, its 3DS2 column on the payments overview is set to No, the removed "Enable 3D Secure Transactions" instruction is gone, and the outdated 3DS Merchant Profile walkthrough has been deleted from the gateway page. The three new findings above are all on the newly written/changed lines of this commit.

Verified as consistent in the incremental diff:

• The 3DS2 gateway list (3ds2-payments.mdx:15-19) and the payments overview table (index.mdx:13-26) now agree: the 9 gateways with 3DS2 = Yes are the same set in both, and PayPal is No in both. The table remains well-formed (two columns, consistent row count).
• No stale PayPal 3DS2 reference remains anywhere in content/. The remaining PayPal mentions (index.mdx:9 APM list, index.mdx:32 3-day authorization expiry, google-pay.mdx:19, paypal.mdx) are unrelated to 3DS2 and are unaffected.
• The new anchor /docs/features/payments/3ds2-payments#3ds-mode at index.mdx:54 resolves to the ### 3DS Mode heading at 3ds2-payments.mdx:27 under fumadocs slugging, and matches the pre-existing usage of the same anchor in risk-screening.mdx:7.

Carried-forward findings from the previous review: all three previously reported issues on the changed lines of 3ds2-payments.mdx (Optimized 3DS2 cell wording, the "every billing country" scoping note, and the Smart mode advice) remain fixed in the current tree and are not re-reported. The only outstanding item from the prior review — the PayPal Commerce Platform page — has now been addressed by this commit and is superseded by the findings above.

Assumptions: Custom instructions referenced .claude/rules for domain docs; that directory does not exist in this repository (only .claude/skills/changelog, a changelog-generation skill with no payments domain rules), so no domain rules were applied. The released platform behaviour behind the PayPal decision (support_3ds2_global / support_3ds2_specific both false in oscar-prime) could not be verified from this repository, so the PayPal findings are based on internal consistency of the documentation and on how the other non-3DS2 gateway pages are worded — they need confirmation against the deployed gateway form. Review is advisory only; no attempt was made to verify labels against the deployed dashboard UI.

Fix these issues in Kilo Cloud

Previous review (commit d18f35d)

Status: 1 Issue Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	1

Issue Details (click to expand)

SUGGESTION

File	Line	Issue
content/docs/features/payments/gateways/paypal-commerce-platform.mdx	34	PayPal Commerce Platform gate still not updated: this is the only gateway page still instructing merchants to choose the removed "Enable 3D Secure Transactions" checkbox, and :36 still describes a 3DS Merchant Profile flow. The page is unchanged by this PR, so it is summary-only; an inline thread on 3ds2-payments.mdx:38 remains open (carried forward)

Files Reviewed (2 files)

• content/docs/features/payments/3ds2-payments.mdx - 0 issues
• content/docs/features/payments/risk-screening.mdx - 0 issues

Incremental review of 1b63b4f: Commits daa424d and d18f35d resolve all three findings previously reported on the changed lines of 3ds2-payments.mdx:

• Line 74 / 76 (was CRITICAL + WARNING): both Optimized 3DS2 cells now read "3DS attempted; if the issuer asks for a challenge, the challenge is skipped and the order is charged without 3DS (see below)". The leading clause is no longer "Charged with 3DS" (which inverted the cell's meaning), and "resubmitted" is gone, so the cells now match the normative mechanism at line 119 ("skip the challenge flow and submit those transactions as non-3DS") and no longer imply two charges on the card.
• Line 80 (was WARNING): the note is now scoped correctly — "On Always On gateways this can happen in any billing country. On Smart gateways it only happens outside the United States, Canada, Australia and New Zealand" — replacing the false "in every billing country" claim. This matches line 72 (Smart | Any | US/CA/AU/NZ is unaffected by the setting) and line 121.
• Line 125: the Smart mode advice now says "a challenged transaction that is charged without 3DS", consistent with the new cell wording and with the mechanism at line 119. A repository-wide search confirms no stale "resubmit" terminology remains on the 3DS2 page.

No new issues were introduced by this incremental diff, and the internal consistency of the rewritten risk table, the liability-shift note, the Smart Mode table, and the Optimized 3DS2 section now holds together.

Carried forward, unrepaired: the PayPal Commerce Platform gateway page. The author declined the change in the existing inline thread at 3ds2-payments.mdx:38, stating that the platform source at the release commit shows PayPal Commerce Platform supporting neither 3DS path, so the existing page is already wrong and PayPal Commerce Platform gets no 3DS Mode. That page is unchanged by this PR, so the finding is reported here only; note that it is listed as a 3DS2-capable gateway on the changed page at 3ds2-payments.mdx:18, so the two pages will contradict each other on docs.nextcommerce.com unless one is updated.

Assumptions: Custom instructions referenced .claude/rules for domain docs; that directory does not exist in this repository (only .claude/skills/changelog, a changelog-generation skill with no payments domain rules), so no domain rules were applied. The released platform behaviour described in the PR body (oscar-prime 2026.10.26.1, take_minfraud) could not be verified from this repository, so findings are limited to internal consistency of the documentation itself. Review is advisory only; no attempt was made to verify labels against the deployed dashboard UI.

Fix these issues in Kilo Cloud

Previous review (commit 1b63b4f)

Status: 4 Issues Found | Recommendation: Address before merge

Overview

Severity	Count
CRITICAL	1
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

CRITICAL

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	74	Rewritten Optimized 3DS2 cell leads with "Charged with 3DS", inverting the cell's meaning: the outcome it describes is a non-3DS charge that carries no liability shift (line 80). The prior wording ("3DS attempted") was precise; "attempted" is not "charged"

WARNING

File	Line	Issue
content/docs/features/payments/3ds2-payments.mdx	76	"Resubmitted" describes a different event sequence than the normative Optimized 3DS2 mechanism at line 119 ("skip the challenge flow and submit those transactions as non-3DS"); the new wording also implies two charges on the card, which the page never addresses
content/docs/features/payments/3ds2-payments.mdx	80	"This applies in every billing country" is false for Smart mode — line 121 bounds Optimized 3DS2 under Smart to orders outside US/CA/AU/NZ, and line 72 shows the Smart US/CA/AU/NZ rows are unaffected by the setting. Only the "including on Always On gateways" clause is accurate

SUGGESTION

File	Line	Issue

|

[Snapshot truncated.]

Additional previous summary content was truncated to keep this comment within platform limits.

---

_{Reviewed by minimax-m3.1-flash · Input: 71.7K · Output: 16.4K · Cached: 761.1K}

[kilo-code-bot]

SUGGESTION: The cell still omits the decline path that Optimized 3DS2 opens up

The new qualifier is right for the normal-risk case, but with Optimized 3DS2 on these orders are risk screened (the next section says Orders that always use 3DS ... are not risk screened unless **Optimized 3DS2** is on), so an order scored above 90 is declined instead of being charged with 3DS. The cell states that every order in this row is charged with 3DS, so a merchant running Smart with Optimized 3DS2 in, say, the EU can have an order declined for risk while this table says it is charged with 3DS.

The row above already carries a risk qualifier (Orders above your risk tolerance are charged with 3DS), so consider pointing this row at the risk rules as well, for example: Charged with 3DS, unless [Optimized 3DS2](#optimized-3ds2) skips the challenge; see [3DS and Risk Screening](#3ds-and-risk-screening).

[next-devin]

Leaving this row short on purpose: the decline path for these orders is covered in 3DS and Risk Screening right below, and the page is being kept to a task-focused guide.

🤖 Addressed by Claude Code