Mobile CTF: Leaky Loyalty Card

You've intercepted network traffic from a mobile loyalty rewards app called 'ShopperPlus'. The app implements SSL pinning, but our pentester already bypassed it using Frida and captured the HTTP traffic with mitmproxy. Below is a hex dump of the raw HTTP response body that was sent when a user checked their loyalty card balance:

code copy
1f8b0800000000000003ed5d0b7813d9b6fe56c0fb3c924477a7ed4c9a264d
9a4e0f49e2b433c9244e373de534ed6d3cf7de7b17bb68c6e26c46631b6bc1
b66cb0d5acbfdfb5e6d8c63ac5961ddbb6fd07a4f5f6f7a5bdd7def9e69f33
8f8d4d66323993cc78f8f0e1c3870f1f3e7cf8f0e1c3870f1f3e7cdc754563
6470617465223a22323032342d30312d31355431343a32333a34355a222c22
6c6f79616c74795f706f696e7473223a343532302c227469657273223a5b7b
22746965725f6e616d65223a22476f6c64222c227468726573686f6c64223a
353030307d2c7b22746965725f6e616d65223a22506c6174696e756d222c22
7468726573686f6c64223a31303030307d5d2c227365637265745f636f6465
223a227368307070335f703072745f62727574655f6631727374227d

The response appears to be gzipped. The app's server sends sensitive data in the loyalty API response that should never be exposed to the client. Your task is to decompress this traffic capture and extract the secret code that's being leaked in the JSON response. This code is used internally by store managers to unlock premium rewards but was mistakenly included in the mobile API.

The flag is the value of the 'secret_code' field from the JSON payload.