id: razorpay-clientid-disclosure

info:
  name: Razorpay Client ID Disclosure
  author: Devang-Solanki
  severity: high
  description: Razorpay Client ID is exposed to external users.
  reference:
    - https://github.com/streaak/keyhacks#Razorpay-keys
    - https://docs.gitguardian.com/secrets-detection/detectors/specifics/razorpay_apikey
  metadata:
    max-request: 1
  tags: exposure,token,razorpay

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    extractors:
      - type: regex
        part: body
        regex:
          - "rzp_(live|test)_.{14}"
# digest: 4a0a00473045022100e3880038e25c2bf95cafa2497e2f8417c901dc35ca96334d818a2c57756e7aff02207c2e0e07794f6fbcbd4f21db92d953a1ef38f759b1059fe0e2b22ea0dd3441a5:922c64590222798bb761d5b6d8e72950