Secret extractor for Square API Secrets

[shipsteady]

• Secret name:
  Square Personal Access Tokens & Square OAuth Application Secrets

• Risk in exposing the secret:
  Exposure of Square API secrets allows attackers to fully impersonate a Square application or merchant account. An attacker could:

  • Access merchant and location information
  • Read or modify payment, customer, order, and inventory data
  • Initiate unauthorized transactions or refunds
  • Perform reconnaissance on connected Square accounts
    These secrets grant direct API access and are typically long-lived, making them high-impact if leaked.

• Secret formats & detection logic:

  • Square Personal Access Tokens

    • Prefix: EAAA

    • Length: 64 characters total

    • Allowed characters: alphanumeric, -, +, =

    • Regex:

      EAAA[\w\-\+\=]{60}
      

  • Square OAuth Application Secrets

    • Prefix: sq0csp-

    • Length: 50 characters total

    • Allowed characters: alphanumeric, _, -

    • Regex:

      sq0csp-[A-Za-z0-9_-]{43}
      

• Validation method, if any

• Fetch merchant metadata:

```
GET https://connect.squareup.com/v2/merchants
Authorization: Bearer <access_token>
```

A successful response confirms the token belongs to a real Square merchant account.

• Enricher plugin opportunity:
  An enricher can:

  • Identify whether the token is production or sandbox
  • Extract merchant ID, country, and business name (if available)
  • Flag scope breadth (read-only vs write-enabled endpoints)

• Token details:

  • Application tokens are tied to specific Square applications
  • Tokens may have broad permissions depending on the app configuration
  • OAuth application secrets are especially sensitive, as they can be used to mint new access tokens

• Resources:

  • Square API documentation:

    • https://developer.squareup.com/docs

  • Square Authentication & OAuth:

    • https://developer.squareup.com/docs/oauth-api/overview

  • Locations API reference:

    • https://developer.squareup.com/reference/square/locations-api

  • Merchants API reference:

    • https://developer.squareup.com/reference/square/merchants-api

[github-actions]

Welcome to the OSV-SCALIBR patch reward program!
Your issue has been added to our triage queue and will reviewed
shortly. The panel usually takes a decision once per week, so it
can take up to a week before you hear back from us.
Please, do not start the work until the panel has reached a
decision. Although we always welcome contributions, unapproved
work is not eligible for a reward.
~The OSV-SCALIBR PRP team

[github-actions]

Congratulations, your request has been approved! 🎉
This means that you can start working on this contribution.
❗ Please take a moment to fill the participation form
If you are unsure where to start, we have compiled a set of
useful guides in our documentation:

• Writing a new vulnerability detector plugin
• Writing a new inventory extraction plugin
• Main directory for secret detectors - More detailed docs will be available soon!
• General style guide

~The OSV-SCALIBR PRP team