From 83c939fc206006a547e564cac5cc939ac666a311 Mon Sep 17 00:00:00 2001
From: root <root@v2202607377162478911.nicesrv.de>
Date: Fri, 14 Aug 2026 09:37:01 -0400
Subject: [PATCH] docs: redact plaintext admin passwords from git audit reports

---
 docs/audit/git-audit-2026-08-07.md |  6 +++---
 docs/audit/git-audit-2026-08-08.md | 14 +++++++-------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/docs/audit/git-audit-2026-08-07.md b/docs/audit/git-audit-2026-08-07.md
index 890b93f..287d3ef 100644
--- a/docs/audit/git-audit-2026-08-07.md
+++ b/docs/audit/git-audit-2026-08-07.md
@@ -18,9 +18,9 @@ Your Git structure has solid bones but significant hygiene gaps. For a private,
 
 The `scripts` repo (11 commits, 75KB) contains Windows provisioning PowerShell scripts with **plaintext passwords committed to history:**
 
-- `LoveMyBoys73!` -- ippadmin MSP backdoor account
-- `Liberty4All!` -- liberty-admin customer admin
-- `tire` -- tire power user
+- `[REDACTED]` -- ippadmin MSP backdoor account
+- `[REDACTED]` -- liberty-admin customer admin
+- `[REDACTED]` -- tire power user
 
 These appear in `dell-reimage-kit/` unattend XML and PowerShell. Even if this repo stays private forever, credentials in git history is a ticking time bomb. One accidental `git clone` to the wrong place and those passwords are exposed.
 
diff --git a/docs/audit/git-audit-2026-08-08.md b/docs/audit/git-audit-2026-08-08.md
index e7b0d59..81eebfc 100644
--- a/docs/audit/git-audit-2026-08-08.md
+++ b/docs/audit/git-audit-2026-08-08.md
@@ -144,9 +144,9 @@ This gives every file a clear home without over-nesting.
 #### `scripts` — 10 potential secrets
 Real, hardcoded credentials found in Windows provisioning scripts:
 ```
-+Password="LoveMyBoys73!"
-+Password="Liberty4All!"
-+Password="tire"
++Password="[REDACTED]"
++Password="[REDACTED]"
++Password="[REDACTED]"
 +Username="ippadmin"
 +Username="liberty-admin"
 ```
@@ -156,10 +156,10 @@ These are active Windows admin credentials embedded in PowerShell unattend scrip
 #### `hermes-recovery` — 8 potential secrets
 Includes the Gitea API token used for this audit:
 ```
-+TOKEN="1761daa2c537fb72b365e54619208329d8e3ad33"
-+TELEGRAM_BOT_TOKEN="8359374835:***"
-+password="K3E1ZZWvHDu0q8ZmoBCAhzKUZawEapdGBlbaPME1sOTKgGk9FCuYS"
-+token = "Ta9f9d1b462271a2f4-8d63a3f025eb89451edb16f2308c2e40"
++TOKEN="[REDACTED]"
++TELEGRAM_BOT_TOKEN="[REDACTED]"
++password="***"
++token = "[REDACTED]"
 ```
 
 The Gitea token itself is committed. This means `hermes-recovery` as a public repo exposes admin credentials.