Why this matters
Build systems aggregate logs and artifacts; leakage here is pervasive and long-lived.
CI logs must redact secrets and CHD; disable shell xtrace, and add a job that fails if PAN regex (e.g., [0-9]{13,19} with Luhn) appears in logs/artifacts. (PCI DSS 4.0 Req. 10 & CI hygiene)
Build systems aggregate logs and artifacts; leakage here is pervasive and long-lived.
Side-by-side examples engineers can pattern-match during review.
steps:
- name: Tests
run: |
set -x # ❌ echoes secrets/CHD
npm teststeps:
- name: Redact and scan
env: { ACTIONS_STEP_DEBUG: 'false' }
run: |
echo '::add-mask::${{ secrets.GATEWAY_KEY }}'
! grep -ERn "\b[0-9]{13,19}\b" ./artifacts || (echo "PAN pattern found" && exit 1)set -xgrep -ERn "\b[0-9]{13,19}\b" ./artifacts || trueFrom the same buckets as this rule.
Never emit Primary Account Number (PAN) or Sensitive Authentication Data (SAD: CVV/CVC, full track data, PIN) to application or audit logs. Per PCI DSS 4.0 Req. 3 and 10, always mask PAN as first6last4 and fully redact SAD before logging.
Reject PRs adding real PAN/CVV in fixtures, seeds, or mocks. Only use Luhn-valid test PANs from the gateway or opaque tokens (e.g., tok_) and never include CVV. Add a check to fail if a PAN regex is matched. (PCI DSS data minimization)