PCI-DSS v4.0
Cardholder data must not be stored, logged, or shipped raw.
3.4 — mask the PAN wherever it is displayed
A card number in a log line, a receipt template or an exception message is a reportable incident, not a style problem. COODDEE treats an unmasked PAN reaching a display or log sink as a failing gate.
3.2 — never store sensitive authentication data
The CVV, the full magnetic stripe and the PIN block must not be retained after authorisation — not in a database column, not in a cache, not in a debug fixture. A test fixture containing a real-shaped CVV is still a finding.
10.x — cardholder data out of the audit trail
The audit record has to be complete enough to reconstruct what happened and clean enough to retain. Those pull in opposite directions, which is exactly why it is worth checking mechanically rather than by review.
COODDEE's own ledger is built to the same rule it enforces: names and outcomes, never values.
These are the requirements decidable by reading source. Network segmentation, key custody and physical controls are assessed against your environment, not against a dependency.