jsqu99/spree_reuse_credit_card — pull request #3 by danmorin (2012-02-20 17:37:23+00:00)
Title: Updated to be compatible with Spree 1.0.0 and added some authorization checking

I updated the code to work with Spree 1.0.0. More importantly, (unless I missed something) your code didn't seem to be validating that the credit card being used at checkout actually belonged to the current user. Since they're auto-ids, it would have been pretty easy to guess another creditcard id and pay using someone else's card.