Finds cardholder and sensitive authentication data in your .sql migrations: CVV, track, PIN block, plaintext PAN columns and test card numbers, each mapped to a PCI DSS Requirement 3 rule. Runs entirely in your browser — nothing is uploaded.
Same engine as the VS Code extension, byte for byte.
This page is the working piece. The full pack has everything below.
Names every column, index, view and seed row in a .sql migration that stores card data, with its PCI DSS Requirement 3 rule id
A QSA-led gap analysis of your data stores is commonly quoted as a five-figure engagement; the same migrations are read here in the editor.
Buy the full version — $29It reads a .sql migration and reports every column, index, view and seed row that stores cardholder data or sensitive authentication data. Each of the 10 rules carries a PCI DSS Requirement 3 id and a replacement line. The 35-line sample migration returns 13 findings from 10 rules, with card numbers always masked.
Backend and platform engineers on a payments repository in Rails, Django, Laravel, .NET or Node, whose company sits inside a PCI DSS assessment scope, and the person who must answer where card data is stored on the SAQ. It is for teams merging migrations written with an assistant.
sqlfluff, sqlint and database checks read syntax and style. None of them know that cvv CHAR(4) is sensitive authentication data that may never be stored after authorisation, or that a unique index on card_number keeps the account number readable inside the index pages. This tool checks meaning, not formatting.
Free and keyless: the .sql file open in your editor, all 10 rules, rule ids and suggested replacements, forever. The full version sweeps every migration in the workspace at once and writes a dated findings report you keep for an assessor or a change ticket, and covers team and commercial use.
A QSA-led gap analysis of your data stores is commonly quoted as a five-figure engagement, and it happens once a year. The PCI DSS v4 requirements that were future-dated became mandatory on 31 March 2025, so Requirement 3 is assessed in full at your next annual assessment. This is $29 once.
One question, answered by the person who built it. Your email only if you want the answer sent.