Will It Vibe?Credit-card-shaped literal in a committed data file
Part of Documentation, UX & Accessibility, which counts for 15% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A 16-digit value that passes the Luhn checksum used by real card numbers was found in a non-test, non-fixture data file. The Luhn check filters out most random-digit false positives.
Why it matters
A 16-digit value that passes the Luhn checksum used by real payment cards sitting in a committed data file means a plausible card number is in source control, retained in history even after deletion and visible to anyone with repository access. PCI DSS treats any storage of primary account numbers as in scope for compliance requirements, and a committed file is one of the easiest ways to fail an audit or leak real card data through a public fork. This check validates the Luhn checksum specifically to cut down on false positives, since a random 16-digit number mostly fails it.
How to fix it
Replace the value with a well-known test card number from your payment processor's documentation (for example the standard 4111 1111 1111 1111 Visa test number) rather than a number that could be real, and confirm no real cardholder data was committed elsewhere in the project's history. Never store real primary account numbers outside your PCI-compliant payment processor.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo