Packages / Payment Service Credentials
Merchant, gateway, payment processor, and transaction-service credentials and tokens.
Detects Braintree (PayPal) OAuth access tokens, which use a distinctive literal dollar-delimited structure: access_token$<environment>$<merchant-id>$<token>. A leaked token allows payment processing and transaction-history access on the connected merchant's behalf.
Detects Plaid API credentials: Item access tokens (access-sandbox-/access-production- followed by an RFC 4122 UUID) and, when labelled with Plaid context, the 30-character hex API secret. A leaked access token exposes a user's linked bank account data; a leaked secret compromises the whole Plaid integration.
Detects the Shopify access-token family: Admin API access tokens (shpat_), custom app access tokens (shpca_), legacy private app passwords (shppa_) and app shared secrets (shpss_), each followed by a 32-character hex body. A leaked token grants API access to a Shopify store, including customers, orders and payment-adjacent data.
Detects Square credential formats: application secrets (sq0csp-, with sandbox- prefixed sandbox variants), legacy personal access tokens (sq0atp-), and current OAuth/personal access tokens (EAAA + 60-character body, context-gated on a nearby Square label because the EAAA base64 shape also occurs in non-Square tokens and encoded blobs). A leaked token or secret enables payment processing and transaction data access in the associated Square account.
Detects Stripe Key patterns.