Skip to main content

PCI Redaction Local QA

Script: scripts/qa/verify_pci_redaction.py

The PCI redaction audit scans local QA artifacts for forbidden payment data patterns. It is meant to catch accidental leaks in generated reports, capture logs, fixtures, and local QA helper scripts.

Command​

./scripts/local-validation/qa.sh test pci-redaction

Scanned Areas​

By default the audit scans:

  • .dev-logs/qa
  • scripts/qa
  • docs/private-docs/docs/qa
  • scripts/staging-cloud-smoke-readiness.sh

Detected Patterns​

  • PAN-like numbers that pass Luhn validation
  • CVV/CVC/security-code field names
  • expiration/expiry field names
  • track-data/magstripe field names

Safe redaction contexts and last-four-only fields are allowed.

Boundary​

This audit proves that the local QA artifact set does not contain obvious PCI-sensitive patterns. It does not replace application-level PCI controls, gateway certification, staging log review, or production observability audits.