ippadmin/itpp-infrastructure
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

docs: redact plaintext admin passwords from git audit reports

Browse Source
This commit is contained in:
root
2026-08-14 09:37:01 -04:00
parent 92d8f4eb6b
commit 83c939fc20
2 changed files with 10 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/audit/git-audit-2026-08-07.md
+3 -3
View File
@@ -18,9 +18,9 @@ Your Git structure has solid bones but significant hygiene gaps. For a private,
The `scripts` repo (11 commits, 75KB) contains Windows provisioning PowerShell scripts with **plaintext passwords committed to history:** The `scripts` repo (11 commits, 75KB) contains Windows provisioning PowerShell scripts with **plaintext passwords committed to history:**
- `LoveMyBoys73!` -- ippadmin MSP backdoor account - `[REDACTED]` -- ippadmin MSP backdoor account
- `Liberty4All!` -- liberty-admin customer admin - `[REDACTED]` -- liberty-admin customer admin
- `tire` -- tire power user - `[REDACTED]` -- tire power user
These appear in `dell-reimage-kit/` unattend XML and PowerShell. Even if this repo stays private forever, credentials in git history is a ticking time bomb. One accidental `git clone` to the wrong place and those passwords are exposed. These appear in `dell-reimage-kit/` unattend XML and PowerShell. Even if this repo stays private forever, credentials in git history is a ticking time bomb. One accidental `git clone` to the wrong place and those passwords are exposed.
docs/audit/git-audit-2026-08-08.md
+7 -7
View File
@@ -144,9 +144,9 @@ This gives every file a clear home without over-nesting.
#### `scripts` — 10 potential secrets #### `scripts` — 10 potential secrets
Real, hardcoded credentials found in Windows provisioning scripts: Real, hardcoded credentials found in Windows provisioning scripts:
``` ```
+Password="LoveMyBoys73!" +Password="[REDACTED]"
+Password="Liberty4All!" +Password="[REDACTED]"
+Password="tire" +Password="[REDACTED]"
+Username="ippadmin" +Username="ippadmin"
+Username="liberty-admin" +Username="liberty-admin"
``` ```
@@ -156,10 +156,10 @@ These are active Windows admin credentials embedded in PowerShell unattend scrip
#### `hermes-recovery` — 8 potential secrets #### `hermes-recovery` — 8 potential secrets
Includes the Gitea API token used for this audit: Includes the Gitea API token used for this audit:
``` ```
+TOKEN="1761daa2c537fb72b365e54619208329d8e3ad33" +TOKEN="[REDACTED]"
+TELEGRAM_BOT_TOKEN="8359374835:***" +TELEGRAM_BOT_TOKEN="[REDACTED]"
+password="K3E1ZZWvHDu0q8ZmoBCAhzKUZawEapdGBlbaPME1sOTKgGk9FCuYS" +password="***"
+token = "Ta9f9d1b462271a2f4-8d63a3f025eb89451edb16f2308c2e40" +token = "[REDACTED]"
``` ```
The Gitea token itself is committed. This means `hermes-recovery` as a public repo exposes admin credentials. The Gitea token itself is committed. This means `hermes-recovery` as a public repo exposes admin credentials.