PCI-DSS 4.0
The pci profile maps findings to the PCI DSS requirements that relate to application code.
vulkro compliance . --profile pci
vulkro compliance-pack . --framework pci-dss-4-0 -o pci-evidence/
The evidence pack covers Requirements 6, 11 and 12 control by control and adds pci-dss-4-0.html, a table that links each control to the Vulkro rule IDs behind it.
Controls
| Control | What fails it |
|---|---|
| Req 6.2 Patch mgmt | A package pinned to a version with a disclosed CVE |
| Req 6.5 Secure dev | Injection, hard-coded credentials, weak crypto, unauthenticated routes |
| Req 6.5.7 XSS / CSRF | Unsafe HTML interpolation, missing CSRF middleware |
| Req 8.2 Authentication | An endpoint that handles or could reach card data with no authentication |
| Req 8.3 MFA / API keys | Hardcoded API keys, JWT secrets or webhook signing secrets in source |
| Req 12.10 IR controls | Payment, refund or account-change flows with no rate limiting (warns) |
Network segmentation, key management and physical security requirements are out of scope for a code scan.
Cardholder data fields
The privacy check classifies card fields such as pan and cvv in request and response shapes, which feeds the data-exposure and PII-in-logs findings.
See also: Compliance overview