Audit my payment flow for PCI scope: confirm that raw card data never touches my servers, my logs, or my database. Verify and fix: card entry happens only in the provider's hosted fields (Stripe Elements, Checkout, or the equivalent, where card numbers go browser-to-provider and I receive a token), never in my own form fields that post to my server; my database stores only provider tokens, customer IDs, and card metadata the provider returns (brand, last four, expiry), never full numbers or CVCs; my logs can't capture card data (check request logging and error reporting for anything that logs request bodies on payment endpoints, and add explicit scrubbing); and analytics or session-replay tools are configured to mask the payment fields, since replay tools record everything users type by default. Search the codebase and the database for anything shaped like a card number (16-digit sequences) and report what you find. Don't build my own card form posting to my server 'to keep the design'; that's the decision that pulls my whole infrastructure into PCI-DSS compliance scope. The provider's fields can be styled. Don't store CVCs ever, under any circumstances; card network rules forbid it. Deliver: the card-data flow map (where numbers exist and where only tokens exist), any violations found and fixed, the log scrubbing, and verification: run a test purchase and grep my server logs and database for the test card number, confirming it appears nowhere.