id: paystack-secret-live

info:
  name: Paystack Secret/Live Key - Exposure
  author: Lloydcoder
  severity: info
  description: |
    Detected exposed Paystack secret keys (test or live) found in application source code, configuration files, or client-side assets.
  reference:
    - https://support.paystack.com/en/articles/2123458
  tags: exposure,token,paystack,fintech,tinlance

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "sk_(live|test)_[0-9a-zA-Z]{50,}"

      - type: word
        words:
          - "paystack"
          - "secret_key"
          - "sk_live"
          - "sk_test"
        condition: or
        case-insensitive: true
# digest: 490a00463044022065abf774ec987fef8b5867831197e5f59d84a38fd9cb9eee5149daab1684976302202ef81587f4b2799d51af6af7070e1590f347d805306f80fe00fccf2c1a7ec92b:922c64590222798bb761d5b6d8e72950