No PAN/CVV in code, database or logs

no-pan-cvv-in-code-db-logsDeterministic

No primary account number or CVV pattern appears in source, fixtures, migrations, seed data or log statements.

v1.0.2 · current

Version 1.0.2

Implementation sha256 Published CWE-312

Verifies: No primary account number, CVV column or card-data log statement in the checkout: code, fixtures, migrations, seeds, SQL, configuration, data files and logs.
Inputs: Every text file of the checkout up to 2 MB (tests and fixtures included; vendored and build folders excluded). Nothing leaves the sandbox. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.
Decision rule: FAIL when (1) a 13-19 digit number with a card-issuer leading digit passes the Luhn check and is not one of the published gateway test numbers, or (2) a schema, migration, model, seed or SQL file declares a CVV/CVC column or a full card-number column (masked, last-four, token and hash columns are allowed), or (3) a log statement outside tests names card-number or CVV data. Test card numbers are reported as informative findings. PASS when the scan ran over at least one text file and no rule fired. Not applicable only when the checkout has no text file.
Type: deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)

const CARD_RUN = /(?<![\w.\-+/#])(?:\d[ -]?){12,18}\d(?![\w.\-+/])/g; // 13-19 digits, single separators allowed

// FAIL if Luhn-valid, issuer-plausible and not a published test number

// FAIL if declared as a column in a schema, migration, model, seed or SQL file

// FAIL if a log statement names card-number or CVV data

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.