We passed a PCI scoping review on the database side with no issues: no PANs stored, tokens only. Then someone searched our error tracker for a 6-digit BIN while debugging an unrelated decline and got hits.

The cause was boring. A JSON parse error in the checkout handler threw before validation, and the tracker's default integration attached the raw request body to the event. Anything a customer typed into the card field, when the payload was malformed, was stored in plaintext for 90 days. We found 41 events with full 16-digit numbers. All of them came from a mobile client version that sent a trailing comma.

What fixed it:

Scrub at the SDK before send, not in the tracker's UI. Server-side scrubbing still means the data crossed the wire to a third party.

Drop request bodies on payment routes entirely. Keep the route, status, and a request ID.

Add a Luhn-pattern check to the log pipeline as a tripwire.…