T1480

Execution Guardrails

discovered 2026-07-09

Card-skimming and merchant-key theft only fire when the Braintree environment is 'production' (IsProduction() / Environment.PRODUCTION check in try/catch defaulting false), so sandbox/dev/QA integrations observe zero exfiltration.

View on MITRE ATT&CK

Seen in packages