Thank you for the clarification. I will be sure to include this in the PH spec when adding the merchant validation feature and will add you the the PR for review.

Hi @marcoscaceres

I agree with the sentiment, but two things make me uncomfortable:

• Imposing a normative requirement on payment handlers in this specification.
• It would probably be ok for the URL to include some information about a person for an authorized server; we don't want that information to be visible to unauthorized parties.

Proposed:

"It is important that the validationURL in a MerchantValidationEvent
does not expose personally identifying information to unauthorized parties."

I am avoiding creating a normative requirement, but do want to stress the importance.