I made a Magento shop for a client.
The only stain on the MSS report is the fact that I'm not using Google Recaptcha in the customer registration form.
For probable GDPR reasons, but mostly personal ethics ones, I don't want Google to have anything to do with the websites I create (I use anonymized logs with Matomo for statistics for example).
Also Google Recaptcha is a PITA if your not using Chrome, and refrain some older customers (this shop is senior oriented)
The problem is that my payment kit provider (a bank) is telling me that not having a clean Magento Security Scan report is bad, and they can stop our contract.
Is there a way to please the MSS without using this forced tier product ?