{"id":"coinpayportal.com/coinpay","name":"coinpay","commands":["coinpay"],"examples":[{"run":"coinpay login","does":"Sign in with OAuth in your browser (--device on a headless box)"},{"run":"coinpay payment create --business-id <business-id> --amount <amount> --blockchain <chain>","does":"Create a crypto payment request and print its address"},{"run":"coinpay payment get <payment-id>","does":"Show a payment's details and status"},{"run":"coinpay payment list --business-id <business-id>","does":"List payments for one of your businesses"}],"description":"SDK and CLI for accepting crypto and card payments, with wallet and swap commands.","homepage":"https://coinpayportal.com","repository":"https://github.com/profullstack/coinpayportal","license":"MIT","agentic":false,"latest_version":"1.0.0","vendor":"Profullstack","install":"curl -fsSL https://coinpayportal.com/install.sh | sh","publisher":"profullstack","w3bs":"w3bs install coinpayportal.com/coinpay","scan":{"status":"passed","scanner":"threatcrush 0.13.30","filesScanned":2370,"summary":{"critical":1,"high":12,"medium":29,"low":61,"info":0},"malware":0,"truncated":true,"version":"1.0.0","sources":{"installer":"https://coinpayportal.com/install.sh","installerSha256":"6619412e7d3bcb5c67849d6ea13ab3278d11bdef9c6b30cba52e0590f5153f26","repository":"github.com/profullstack/coinpayportal","commit":"2bcf58565f6602ff3105c39b9612c79d9b5aab63"},"notes":[],"scannedAt":"2026-11-02T20:22:41.709Z","findings":[{"ruleId":"secret-private-key","title":"Private Key","severity":"critical","category":"secret","cwe":"CWE-798","file":"source/.env.example","line":255,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"high","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":405,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/docs/API.md","line":430,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/docs/API.md","line":589,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/docs/sdk/getting-started.md","line":36,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/docs/sdk/getting-started.md","line":318,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/extension/scripts/make-screenshots.mjs","line":283,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/packages/sdk/README.md","line":99,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"high","category":"code","cwe":"CWE-494","file":"source/public/install.sh","line":405,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":135,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":214,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":1401,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"high","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":1533,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":153,"malware":false},{"ruleId":"sh-unquoted-expansion-destructive","title":"unquoted expansion in a destructive command","severity":"medium","category":"code","cwe":"CWE-78","file":"installer/install.sh","line":713,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":816,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":817,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"installer/install.sh","line":818,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/extension/scripts/make-screenshots.mjs","line":256,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"medium","category":"code","cwe":"CWE-95","file":"source/packages/extension/scripts/make-screenshots.mjs","line":265,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/public/install.sh","line":153,"malware":false},{"ruleId":"sh-unquoted-expansion-destructive","title":"unquoted expansion in a destructive command","severity":"medium","category":"code","cwe":"CWE-78","file":"source/public/install.sh","line":713,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/public/install.sh","line":816,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/public/install.sh","line":817,"malware":false},{"ruleId":"sh-remote-script-execution","title":"network output piped into a shell","severity":"medium","category":"code","cwe":"CWE-494","file":"source/public/install.sh","line":818,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/public/payments.js","line":93,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/public/payments.js","line":139,"malware":false},{"ruleId":"js-predictable-cipher-iv","title":"static initialization vector","severity":"medium","category":"code","cwe":"CWE-329","file":"source/scripts/decrypt-wallet-backup.mjs","line":31,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/src/app/blog/[slug]/page.tsx","line":133,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/app/invoices/[id]/pay/page.tsx","line":164,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/src/app/layout.tsx","line":114,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/app/login/page.tsx","line":28,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/app/login/page.tsx","line":32,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/app/login/page.tsx","line":145,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/app/oauth/consent/page.tsx","line":87,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/components/business/PayPalConnectTab.tsx","line":169,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/components/business/StripeConnectTab.tsx","line":142,"malware":false},{"ruleId":"js-open-redirect","title":"redirect to a non-constant destination","severity":"medium","category":"code","cwe":"CWE-601","file":"source/src/components/business/StripeTab.tsx","line":178,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"medium","category":"code","cwe":"CWE-79","file":"source/src/components/PitFooter.tsx","line":25,"malware":false},{"ruleId":"js-jwt-decode-without-verify","title":"JWT decoded without verifying the signature","severity":"medium","category":"code","cwe":"CWE-347","file":"source/src/lib/auth/jwt.ts","line":88,"malware":false},{"ruleId":"redos-nested-quantifier","title":"regex with nested unbounded quantifiers","severity":"medium","category":"code","cwe":"CWE-1333","file":"source/src/lib/auth/spam-detection.ts","line":45,"malware":false},{"ruleId":"js-predictable-cipher-iv","title":"static initialization vector","severity":"medium","category":"code","cwe":"CWE-329","file":"source/src/lib/crypto/encryption.ts","line":103,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/docs/FIX_VERIFY_SIGNATURE.md","line":156,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/docs/integration-examples/nodejs-bot.md","line":225,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/sdk/README.md","line":122,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/sdk/README.md","line":874,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/sdk/test/business-create.test.js","line":56,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/packages/sdk/test/escrow.test.js","line":188,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/packages/sdk/test/tax-sources.test.js","line":107,"malware":false},{"ruleId":"js-dynamic-code-execution","title":"dynamic code execution","severity":"low","category":"code","cwe":"CWE-95","file":"source/packages/sdk/test/tax-sources.test.js","line":110,"malware":false},{"ruleId":"js-regex-from-input","title":"regular expression compiled from a variable","severity":"low","category":"code","cwe":"CWE-1333","file":"source/src/app/api/oauth/authorize/route.test.ts","line":52,"malware":false},{"ruleId":"js-unescaped-html-sink","title":"unescaped HTML rendering","severity":"low","category":"code","cwe":"CWE-79","file":"source/src/app/docs/prompts/[slug]/page.tsx","line":37,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":1001,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":1022,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":1482,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/app/docs/sdk/page.tsx","line":1491,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/components/docs/AuthenticationDocs.tsx","line":37,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/components/docs/OAuthDocs.tsx","line":281,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/components/lightning/__tests__/LightningSetup.test.tsx","line":58,"malware":false},{"ruleId":"secret-jwt","title":"JSON Web Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/auth/apikey.test.ts","line":308,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/auth/apikey.test.ts","line":308,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/auth/jwt.test.ts","line":136,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/auth/jwt.test.ts","line":183,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/crypto/encryption.test.ts","line":212,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/crypto/encryption.test.ts","line":220,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":108,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":402,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":418,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":419,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":435,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":436,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":598,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":599,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/escrow/service.test.ts","line":730,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/multisig/adapters/evm-safe.test.ts","line":187,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/multisig/engine.test.ts","line":279,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/multisig/engine.test.ts","line":280,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/multisig/engine.test.ts","line":281,"malware":false},{"ruleId":"secret-generic-api-key","title":"Generic API Key","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/proposals/notify.test.ts","line":20,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/proposals/notify.test.ts","line":20,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/wallet-sdk/__tests__/sdk-integration.test.ts","line":695,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/wallet-sdk/backup-wallet.test.ts","line":39,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/wallet-sdk/backup-wallet.test.ts","line":58,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/wallet-sdk/backup.test.ts","line":7,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/wallet-sdk/backup.test.ts","line":65,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/__tests__/send-transaction-flow.test.ts","line":236,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/__tests__/send-transaction-flow.test.ts","line":409,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/client-crypto.test.ts","line":23,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/identity.test.ts","line":19,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/identity.test.ts","line":24,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/identity.test.ts","line":27,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/identity.test.ts","line":64,"malware":false},{"ruleId":"secret-generic-credential","title":"Hardcoded Credential","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/seedphrase-backup.test.ts","line":61,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/signing.test.ts","line":195,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/signing.test.ts","line":268,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/signing.test.ts","line":335,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/signing.test.ts","line":346,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/signing.test.ts","line":347,"malware":false},{"ruleId":"secret-hex-token","title":"High-entropy Hex Token","severity":"low","category":"secret","cwe":"CWE-798","file":"source/src/lib/web-wallet/signing.test.ts","line":376,"malware":false},{"ruleId":"insecure-randomness-for-secret","title":"predictable randomness used for a security value","severity":"low","category":"code","cwe":"CWE-338","file":"source/src/lib/web-wallet/wallet-registry.test.ts","line":25,"malware":false}]}}