Skip to content

PayPal sandbox only. No real money moves.

OperatorsSafety

Sandbox-only safety

The rules that keep GAVEL on the PayPal sandbox and keep secrets out of the repository.

Verifiedbacked by a real run or committed evidence

Page last changed 7 Nov 2026 (from the git history)

GAVEL talks to the PayPal sandbox only. No live PayPal call is made and no real money moves. Do not put real card numbers, real accounts or personal data into the demo.

Rules in the code

  • PAYPAL_ENV accepts only sandbox. Production mode (NODE_ENV=production, or any public https host) refuses PAYMENTS=fake, weak secrets and the test hooks.
  • The scripted demo routes mount only with DEMO_MODE=1 and PAYMENTS=fake, which config refuses under production-like settings.
  • The crash kill hook (GAVEL_CHECKPOINT_KILL) is refused in production.
  • A CI check fails the build when source or configuration names the live PayPal host.
  • Sandbox accounts must be US accounts and gates send USD.

Secrets

Secrets are never committed. Names only appear in the docs: PAYPAL_CLIENT_ID, PAYPAL_CLIENT_SECRET, PAYPAL_WEBHOOK_ID, TOKEN_SECRET, ADMIN_KEY, the voice provider keys. CI scans the history for secrets and builds the web bundle with canary secrets to prove none leaks into it. Report a vulnerability as described in SECURITY.md.

Kill switch

The payments layer has a kill switch. While it is engaged no new capture is sent; a capture that is already at PayPal is still adopted, and the unknown-outcome clock stands still. Voids are not blocked.

Edit on GitHub

Last updated on

Incident response unverified

What to do, in order, when money state looks wrong. Built only from what the repository documents.

Threat model unverified

Who can do what, where the trust boundaries are, and what each secret protects. Names only, never values.

On this page

Rules in the codeSecretsKill switch