Progress

0 / 12 secrets disclosed this session. None of these artifacts are linked from the visible app (Home / About / Login). Two of the DB passwords hide in git (one in the exposed config, one still in history), and the admin API key is baked into the JS bundle.

Chain check: ⬜ not yet: recover a key and prove it against /m08/api/admin?key=<key>.

⬜ Exposed .git (/.git/config leaks an internal remote URL with an embedded CI token)

⬜ Committed-then-removed secret recovered from git history (old commit blob -> DB password)

⬜ Exposed .env (DB credentials + APP_KEY)

⬜ Config backup (/settings.py.bak with a hardcoded SECRET_KEY)

⬜ JS source map (/static/app.js.map leaks internal source paths + a key)

⬜ Hardcoded API key found in the JS bundle (/static/app.js)

⬜ Verbose error / debug (stack trace dumps a DB DSN with password)

⬜ Actuator-style env dump (/actuator/env exposes a credential)

⬜ OpenAPI/Swagger spec (/openapi.json lists a hidden admin endpoint + example key)

⬜ Browsable backup directory (/backup/ -> read the interesting file)

⬜ Backup archive downloaded (/backup.zip contains credentials.txt)

⬜ USED a recovered secret: the gated admin API accepted the leaked key