VNX-SEC-046: Square access token
Reports Square access tokens (EAAA plus 56-64 characters, or legacy sq0atp- OAuth tokens) standing alone in files; EAAA inside base64 blobs is not reported.
| Field | Value |
|---|---|
| Rule ID | VNX-SEC-046 |
| Severity | Critical |
| SARIF level | error |
| Kind | secrets |
| Languages | Any file |
| CWE | CWE-798 |
| CAPEC | CAPEC-191 |
| ATT&CK | T1552.001 |
| CWSS vector | CWSS:1.0/TI:C/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:C/DI:H/EX:H/EC:N/P:W |
| Tags | secrets square payments credentials |
| Source | internal/sast/rules/vnx-sec-046.rego |
Overview
This rule reports a Square access token: a production or sandbox access token (EAAA followed by 56 to 64 base64url characters) or a legacy OAuth access token (sq0atp- followed by 22 to 43 characters), standing alone rather than inside a longer base64 run. EAAA inside an embedded image, font or certificate, placeholders (EAAAxxxx..., sq0atp-REPLACE...), low-entropy values, environment lookups and test, fixture and vendored paths are not reported, and the snippet is redacted.
Why This Matters
Hardcoded square access token values are routinely scraped by automated bots within minutes of a public push, and then used to access the account, exfiltrate data, or pivot into downstream services. Once the credential is in git history it is permanently in third-party hands.
Remediation
- Revoke the leaked credential in the provider’s console immediately.
- Replace with a short-lived alternative, OAuth 2.0 access tokens, IAM role assumption, OIDC federation, wherever the platform supports it.
- Store the new credential in a secrets manager (AWS Secrets Manager, HashiCorp Vault, GitHub Actions secrets, Doppler).
- Audit the provider’s access logs for activity you did not initiate between the leak and the revocation.
- Purge from git history with
git filter-repoor BFG, then re-scan with gitleaks/truffleHog to confirm no other secrets remain. - Enable push protection so future commits are blocked at the developer machine.
References
- CWE-798: Use of Hard-coded Credentials
- gitleaks
square-access-token - truffleHog
- OWASP Credentials Management Cheat Sheet
- MITRE ATT&CK T1552.001 – Credentials In Files
- git-filter-repo
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-sec-046
// nosec vnx-sec-046Or record an ignore rule: vulnetix ignore add --rule vnx-sec-046 --reason "...". See Suppressing findings.