A commented-out condition // || 'yes' === $this->auth3ds20_mpi_is_active was left in the antifraud production guard, making the intended antifraud/3DS interaction ambiguous and fragile to maintain.

Changes

• Removed the dead auth3ds20_mpi_is_active check — antifraud is intentionally allowed alongside 3DS since hotfix Hotfix 3ds antifraud together #117
• Added an inline comment on the guard block documenting that the 3DS restriction was lifted and clarifying which conditions still bypass antifraud

// Antifraud is allowed to run alongside 3DS; only skip when antifraud is
// disabled, not configured to send with the Pagador transaction, or SOP is active.
if (
    'yes' !== $this->antifraud_enabled
    || 'yes' !== $this->antifraud_send_with_pagador_transaction
    || 'yes' === $this->sop_enabled
) {
    return $payment_data;
}

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.