itpp-infrastructure/audit/phase-one/findings/git-a.md

Git-A Findings: Gitea Repository Audit (git.itpropartner.com)

Auditor: Git-A (claude-sonnet-5, subagent under Phase One ITPP Infrastructure Audit) Scope: Full repo inventory, local/remote cross-reference, classification, lineage, secrets-in-history, disposition recommendations. Method: READ-ONLY. All findings verified against the live Gitea API and local clone git history. Nothing was modified, deleted, renamed, force-pushed, or rotated. All remediation is written up below as a Phase Two recommendation. Date: 2026-08-13

---

1. Full Inventory

Enumerated via GET /api/v1/user/repos?token=...&limit=100, paginated (2 pages, page 3 empty). Total repos on Gitea: 56. All owned by ippadmin. None are flagged empty: true.

Repo	Private	Size (KB)	Default Branch	Last Updated
apex-track	No	28	main	2026-08-09
auth	Yes	42	main	2026-08-08
backup-restore	Yes	29	main	2026-08-08
boxpilot	No	27	main	2026-08-09
cartmylist	No	70	main	2026-08-05
competitive-landscape-research	No	75	main	2026-08-10
content-creation-pipeline	Yes	27	main	2026-08-08
digital-signage	No	82	main	2026-08-08
disaster-recovery	No	82	main	2026-08-08
dre	No	117	main	2026-08-08
fleettracker360	No	26	main	2026-08-08
forefront-wireless-portal	No	57	main	2026-08-08
furniture-pos	Yes	56	main	2026-08-12
gift-a-roast	No	28	main	2026-08-08
hermes-recovery	Yes	455	main	2026-08-09
hermes-skills	No	13807	main	2026-08-08
homelab	Yes	42	main	2026-08-09
hudu	No	32	main	2026-08-08
itpp-docs	No	946	main	2026-08-10
itpp-infrastructure	No	727	master	2026-08-12
itpp-standards	No	28	main	2026-08-09
itpropartner-website	Yes	36	main	2026-08-08
launchcheck	No	59	main	2026-08-09
mcp-browser	No	27	master	2026-08-08
mcp-email	No	26	master	2026-08-08
mcp-filesystem	No	26	master	2026-08-08
mcp-git	No	26	master	2026-08-08
mcp-servers	No	27	main	2026-08-08
model-fallback	Yes	43	main	2026-08-08
mooresunnydaze	No	107	main	2026-08-08
msp-forms	Yes	44	master	2026-08-08
nvr-shield	No	33	main	2026-08-08
ops-portal	Yes	31	main	2026-08-08
ops-reports	Yes	44	main	2026-08-12
org-audit	Yes	472	master	2026-08-09
osint-tool	No	37	main	2026-08-09
personal-assistant	Yes	82	main	2026-08-08
pipeline	Yes	41	main	2026-08-08
pry	Yes	39	master	2026-08-08
research-search-mcp	Yes	63	main	2026-08-08
scripts	Yes	75	main	2026-08-08
seo-tool	No	43	master	2026-08-10
shark-game	No	30	main	2026-08-08
shonuff-caller	Yes	31	main	2026-08-08
startup-studio	Yes	43	main	2026-08-08
super-search	No	39	master	2026-08-08
super-search-business	No	57	main	2026-08-08
track-a-flock	Yes	35	main	2026-08-08
transitpin	Yes	129	main	2026-08-09
unifi	No	27	main	2026-08-08
unms	No	27	main	2026-08-08
venturebuilt	No	47	master	2026-08-10
verdicttank	No	145	main	2026-08-12
voice-agent	Yes	32	master	2026-08-08
voipsimplicity	No	68	main	2026-08-08
voipsimplicity-manual	Yes	448	main	2026-08-08

Note: itpp-infra (singular, no "structure") does not appear in this list. Confirmed separately below (Section 4, Lineage) that it has been deleted server-side since the last local clone was made.

---

2. Cross-Reference: Gitea vs Local Clones

Local clones live under /root/projects/. 67 top-level directories exist there; 48 are real git repos (have a .git directory), 19 are plain project folders (docs, scratch dirs, or research artifacts with no version control).

2a. Gitea repos with NO local clone (11 repos)

These exist server-side but Git-A found no corresponding directory under /root/projects/. Cannot verify their content/purpose without a local clone; flagged as an access/visibility gap per Brief Rule 4.

Repo	Private	Size	Notes
itpp-docs	No	946KB	Aggregated MkDocs site - likely owned by Docs-W's workstream
mcp-browser	No	27KB	MCP server source, master branch
mcp-email	No	26KB	MCP server source, master branch
mcp-filesystem	No	26KB	MCP server source, master branch
mcp-git	No	26KB	MCP server source, master branch
msp-forms	Yes	44KB	master branch
pry	Yes	39KB	"pry service", master branch, no description
seo-tool	No	43KB	ITPP SEO audit tool, master branch
super-search	No	39KB	MCP server source (distinct from super-search-business)
venturebuilt	No	47KB	AI business dev platform, master branch
voice-agent	Yes	32KB	master branch

Why it matters: Git-A cannot confirm what's in these 11 repos beyond Gitea's own metadata (name/description/size). If Sys-A/Sys-B or Sec-A need to verify what's actually deployed from these repos, they'll need a fresh clone - this audit's local-clone cross-reference has a blind spot here. All 11 also share the pattern of being either MCP micro-services or product-dev tools that may have been scaffolded once and forgotten (small size, single description, no CHANGELOG visible from metadata alone).

2b. Local repos with NO Gitea remote match ("local-only", no off-server backup)

None found with truly missing remotes - deep-scan.py reported 0 local-only repos (every .git-bearing directory under /root/projects/ has a configured origin). However, two categories of concern:

• itpp-infra - has an origin pointing at git.itpropartner.com/ippadmin/itpp-infra.git, but the repo no longer exists on the Gitea server (git ls-remote returns remote: Repository not found, HTTP 404 on the repos API). This is an orphaned local clone of a deleted remote - effectively local-only now, with 3 commits of history that exist nowhere else. See Section 4.
• 2 repos use GitHub, not Gitea, as their remote: msp-claude-skills (github.com/RTFM-IT-Services-LLC) and viral-content-system (github.com/swaroop2004/Proven-Viral-Content-System - a fork of an external template, not an ITPP-authored repo). These are outside Gitea's scope entirely; flagged for awareness, not an audit failure.

2c. Non-repo project folders under /root/projects/ (19 total, no git at all)

asher-and-rye-m365-consolidation, competitive-analysis, diglocate, forefront-broadband-map, giftaroast, kids-school-calendar, mautic-multitenant, mcp-planning, mcp-registration, mikrotik-monitoring, obsidian-selfhost, paperless-ngx, personal-shopping-assistant, portal-design-system, rfptank, school-calendar-2026-2027, twilio-10dlc, udm-tailscale, village-express.

These are working directories, research scratch space, or planning docs - not under version control at all, so they carry zero off-server backup. Not directly this audit's remit (no Git history to inventory), but worth flagging to Sys-C/the conductor: any of these with real deliverable content (giftaroast has working Python files, e.g.) has no backup whatsoever, git or otherwise, beyond whatever the general server backup captures.

---

3. Classification

Classified by last-commit recency and inferred purpose/domain. "Active" = commit within last 5 days as of audit date (2026-08-13) AND has ongoing purpose; "Stale" = >5 days idle but still relevant; "Superseded" = replaced by a newer/renamed repo; "Orphaned" = remote gone, dangling reference, or abandoned scaffold.

Active (commits within last ~5 days, live purpose)

itpp-infrastructure (age 0d, 90 commits - actively growing), furniture-pos (0d), ops-reports (0d), verdicttank (0d), competitive-landscape-research (2d), transitpin (3d), homelab (3d), itpp-standards (3d), org-audit (3d, private audit-artifact repo - still being appended to for this very engagement).

Domain split: itpp-infrastructure / homelab / itpp-standards / org-audit = internal infra. furniture-pos / transitpin / forefront-wireless-portal = client-facing. verdicttank / competitive-landscape-research / launchcheck = product-dev micro-SaaS.

Stale (idle 4+ days, no evidence of abandonment - most repos)

The overwhelming majority of the 46 Gitea-backed local clones sit at exactly 2026-08-08, ~13:06-13:08 - a single mass-scaffolding event, not organic development. This includes: apex-track, auth, backup-restore, boxpilot, cartmylist, content-creation-pipeline, digital-signage, dre, fleettracker360, forefront-wireless-portal, gift-a-roast, hermes-recovery, hermes-skills, hudu, itpp-infra, launchcheck, mcp-servers, model-fallback, mooresunnydaze, msp-claude-skills, nvr-shield, ops-portal, osint-tool, personal-assistant, pipeline, research-search-mcp, scripts, shark-game, shonuff-caller, startup-studio, super-search-business, track-a-flock, unifi, unms, viral-content-system, voipsimplicity, voipsimplicity-manual.

This pattern (dozens of repos all touched in the same 2-minute window on Aug 8) strongly suggests a batch .gitignore/scaffolding pass (consistent with the git-audit skill's own Step 9 "batch remediation" - likely a prior audit's cleanup run) rather than genuine feature work. Domain split: roughly half internal-infra/ops tooling (auth, backup-restore, hudu, unifi, unms, model-fallback, ops-portal, personal-assistant, pipeline, shonuff-caller, mcp-servers), half product-dev micro-SaaS prototypes (apex-track, boxpilot, dre, fleettracker360, gift-a-roast, launchcheck, mooresunnydaze, nvr-shield, osint-tool, shark-game, startup-studio, super-search-business, track-a-flock, voipsimplicity, voipsimplicity-manual) plus a couple of client-facing scaffolds (digital-signage, forefront-wireless-portal, cartmylist).

Superseded / Duplicate

• itpp-infra superseded by itpp-infrastructure (see Lineage below - do not confuse them per skill pitfall).
• cartmylist-repo (local dir name) is the same project as Gitea's cartmylist - naming drift, not two repos (confirmed: same remote URL). Not a true duplicate but flagged for local-directory-name hygiene.

Orphaned

• itpp-infra - remote deleted server-side; local clone is now a dangling reference to nothing. 3 commits of unique history exist only in this local clone.

---

4. Lineage: Duplicates, Forks, Naming Collisions

Pair	Status	Verdict
itpp-infra vs itpp-infrastructure	itpp-infra: local clone exists (3 commits, "Initial commit -- audit Jul 24 2026" as its most substantive commit), but the Gitea remote no longer exists - confirmed via git ls-remote (Repository not found) and direct API call (404). itpp-infrastructure: 90 commits, actively updated as of today (2026-08-13), 727KB, is the working audit/documentation repo, default branch on Gitea is master while local clone tracks main (branch mismatch - see below).	itpp-infra is dead/orphaned. itpp-infrastructure is the live, correct repo. Do not confuse the two per skill's known pitfall - confirmed still true.
cartmylist (Gitea) vs cartmylist-repo (local dir name)	Same repo, same remote URL (git.itpropartner.com/ippadmin/cartmylist.git), local clone directory is just named differently (cartmylist-repo). Not a real duplication - it's local naming drift.	No consolidation needed; rename local directory for clarity in Phase Two, non-urgent.
gift-a-roast (Gitea+git) vs giftaroast (local, no git)	Two different local directories. gift-a-roast is the real git-tracked repo (28KB, matches Gitea). giftaroast is an untracked scratch directory containing loose Python fix-scripts (fix_auth.py, fix_dict.py, fix_final.py) and an index.html - looks like ad-hoc debugging output that predates or parallels the real repo, never committed anywhere.	giftaroast (no-git) should be reviewed and either merged into gift-a-roast's history or deleted as scratch work - currently has zero backup.
super-search vs super-search-business	Two distinct Gitea repos. super-search = "super-search MCP server source code" (39KB, master branch, no local clone found). super-search-business = "Super Search for Business - multi-tenant competitive intelligence & OSINT SaaS platform" (57KB, main branch, cloned locally). Different products (infra tool vs. product-dev SaaS), not a duplicate - naming is just confusingly similar.	Not a collision requiring merge; recommend renaming one for clarity (e.g. super-search-mcp vs super-search-business) in Phase Two docs pass.
mcp-servers vs mcp-browser / mcp-email / mcp-filesystem / mcp-git	mcp-servers (cloned locally, "MCP servers for Open WebUI") appears to be a monorepo/aggregator. The four mcp-* singles (browser/email/filesystem/git) are NOT cloned locally, all sit on master branch (older default, out of step with the main convention used elsewhere), and are small (26-27KB each) with generic " MCP server source code" descriptions.	Consolidation candidate: verify whether mcp-servers already contains these four as subdirectories (would need a fresh clone to confirm - Section 2a gap). If duplicated, the four standalone repos are consolidation-into-mcp-servers candidates.
itpp-docs vs itpp-standards vs itpp-infrastructure	Three separate repos all touching "ITPP documentation": itpp-docs = "Aggregated MkDocs documentation site for all IT Pro Partner projects" (946KB, not cloned locally); itpp-standards = "ITPP documentation standards, templates, and CI workflows" (28KB, 1 commit only); itpp-infrastructure = the working infra/audit repo with actual runbooks (727KB, 90 commits).	Not true duplicates (each has distinct scope: standards/templates vs published docs site vs raw infra runbooks) but worth flagging to Docs-W for the Git/Docs reorg recommendation - three repos with "docs" in scope invites confusion about which is canonical for what.

Branch mismatch flag (per skill's known pitfall, independently reverified today): itpp-infrastructure's local clone tracks main while Gitea's default_branch is master. This is not cosmetic - it means anyone cloning fresh from Gitea without specifying a branch lands on master, which may be stale relative to the main-tracking local clone that's actually being worked in daily. Confirmed both branches exist on the remote (origin/master and origin/main both resolve). This should be fixed in Phase Two: pick one branch, make it Gitea's default, delete the other.

Six other repos still default to master on Gitea rather than the main convention used everywhere else: mcp-browser, mcp-email, mcp-filesystem, mcp-git, msp-forms, pry, seo-tool, super-search, venturebuilt, voice-agent, and locally org-audit. Consistent naming convention is a Phase Two hygiene item, not a security risk.

---

5. Secrets-in-History

Scanned via the skill's regex pattern across full git history (git log -p --all) for all 46 Gitea-backed local clones, filtered against the false-positive list (publicKeyToken, doc-example/placeholder values, ?token= in URLs). Manual review of every raw hit below; only REAL, exploitable values are recorded with [REDACTED] substituted for the actual secret.

CRITICAL

1. scripts repo - hardcoded Windows admin passwords in provisioning script, repo is PRIVATE but still exposed to anyone with repo access/token leak

• Repo: scripts (private=true)
• Commits: ec6e0e1b9894b9c7e16793aafacc4681f988bf86 ("Liberty: add ippadmin MSP backdoor account alongside liberty-admin customer admin"), fef88f8d634957c538b3a800c9db1093bb9c3520 ("Refactor to two-script architecture..."), 2497f4c0c03b1435dcd9f59161a25d3b9383cc9f ("Standard onboard v2...")
• File: dell-reimage-kit/standard-onboard.ps1
• Value: [REDACTED] - plaintext local-admin passwords for an "ippadmin MSP backdoor account" (used across all client onboards) and a "liberty-admin" customer admin account, embedded directly in a PowerShell provisioning script.
• Why it matters: This is a credential used to provision a hidden admin account on every client machine imaged with this kit - a live, reusable master-key password baked into source control. Even though the repo is private, anyone with read access to Gitea (or a leaked API token, see finding 3 below) gets a password that likely still works on production client endpoints today.
• Disposition: Rotate the password at the source (change it on any machine it was actually used on), then scrub history per the skill's Step 8 workflow, force-push, and verify.

HIGH

2. itpp-infrastructure repo - same passwords re-exposed, but this time in a PUBLIC repo

• Repo: itpp-infrastructure (private=false)
• Commits: a269a17b1f40460b0ef96ca234233167564b404d ("git-audit: 42-repo hygiene audit Aug 8..."), de0190283b6c89b399a9089dbaa1865e0b4cb337 ("docs: Git structure audit -- 40 Gitea repos...")
• Files: docs/git-audit-2026-08-08.md, docs/git-audit-2026-08-07.md
• Value: [REDACTED] - the same "ippadmin"/"liberty-admin" MSP backdoor passwords from Finding 1, quoted verbatim inside a prior audit report that a previous Git-A wrote and committed to this repo as evidence of the finding.
• Why it matters: This is worse than Finding 1 in one dimension: itpp-infrastructure is a public repo. A previous audit correctly identified the scripts repo credential leak, but then re-leaked the same credential by quoting it verbatim into a report and pushing that report to a public repo. Anyone on the internet who finds git.itpropartner.com/ippadmin/itpp-infrastructure can clone it and git log -p these two commits to get the same admin password. This is a textbook example of why the Brief's Rule 5 ("emit [REDACTED] everywhere, including paths that contain secrets") exists - Git-A is following it here; a prior pass did not.
• Disposition: Rotate the same credential (covers both findings 1 and 2 at once), then scrub history from itpp-infrastructure specifically since it's public-facing, force-push, verify with a fresh clone. Treat as higher urgency than Finding 1 purely because of public exposure, even though it's the same underlying secret.

3. hermes-recovery repo - live database password + the actual Gitea API token used for this very audit, committed to history

• Repo: hermes-recovery (private=true)
• Commit: ae056eaf83b3d9ed273b68bce635aef8fdd1d665 ("Initial resurrection kit - 81 scripts, 62 references, configs, systemd units, crons, Docker compose files, Caddy config, master README")
• Files: scripts/apex-mail-watchdog.py (MySQL password for user apextrackexperience_1781549652), configs/config.yaml (a Gitea API token value)
• Value: [REDACTED] (both)
• Why it matters: Two separate live secrets in one commit: a MySQL credential for what looks like a production WordPress/mail-watchdog database, and a Gitea API token embedded directly in a backup config file. The repo is private, which limits blast radius to whoever has Gitea access - but "resurrection kit" repos exist specifically to be handed to whoever needs to rebuild the server, meaning this file is likely to be read, copied, and pasted elsewhere by design. That's exactly how a scoped secret becomes an unscoped one.
• Disposition: Rotate both the DB password and the Gitea token, scrub history, verify. Because this token may be the same token used to authenticate this very audit run (structurally identical format), Phase Two should explicitly confirm whether it's live before assuming it's already been rotated.

MEDIUM (documentation artifacts, not live secrets - recorded for completeness, not actionable as leaks)

• hermes-skills repo: 15 regex hits, all reviewed - every one is a documentation example (SOME_API_KEY: "value", secret: "generate-a-strong-secret-here", shell snippets showing how to extract a key from a config file rather than an actual key value). No real secret. Two large files flagged separately (skills/.curator_backups/.../skills.tar.gz at 2.7MB and skills/.hub/index-cache/hermes-index.json at 38MB) - per the skill's known pitfall, this is a legitimate mirror repo and these are cache artifacts that should be gitignored, not evidence of misuse.
• org-audit repo: 3 regex hits, all reviewed - SMTP_PASSWORD: '<REDACTED>' is literally the placeholder string <REDACTED> already in the source (a prior audit's own sanitized report), ADMIN_TOKEN hit is a comment noting no token is set, temporary-password-here is a literal placeholder. No real secret - this repo is itself sanitized audit output and correctly follows the redaction convention.

Summary table

Severity	Repo	Public/Private	Real secret?	Commits
CRITICAL	scripts	Private	Yes - admin passwords	3 commits
HIGH	itpp-infrastructure	Public	Yes - same admin passwords, re-leaked	2 commits
HIGH	hermes-recovery	Private	Yes - DB password + Gitea API token	1 commit
Info-only	hermes-skills	Public	No - doc examples only	n/a
Info-only	org-audit	Private	No - already redacted in source	n/a

No live secrets found in any of the 46 scanned repos beyond the three real findings above. The 11 repos in Section 2a (no local clone) could not be scanned and remain an access/visibility gap - flag for Phase Two follow-up if their content needs verification.

---

6. Disposition Recommendations

Repo	Classification	Recommendation	Rationale
itpp-infra	Orphaned (remote deleted)	Archive/delete local clone	Remote no longer exists; 3 commits of unique local history should be reviewed once for anything not already in itpp-infrastructure, then the local clone can be safely removed. Not backed up anywhere else.
itpp-infrastructure	Active	Keep-active; fix branch default	Live, growing, canonical infra/audit repo. Fix the main/master default-branch mismatch first (Phase Two).
cartmylist-repo (local dir)	Active (as cartmylist on Gitea)	Keep-active; rename local dir	Same repo as Gitea's cartmylist, just named differently locally. Cosmetic fix only.
giftaroast (local, no git)	Untracked scratch work	Merge-into gift-a-roast or delete	Loose debugging scripts with no version control and no backup. If content is still useful, commit into gift-a-roast's history; otherwise delete as scratch.
mcp-browser / mcp-email / mcp-filesystem / mcp-git	Stale, not locally verifiable	Merge-into mcp-servers (pending verification)	Small, single-purpose repos with generic descriptions on the outdated master branch. Likely duplicated inside the mcp-servers monorepo - needs a fresh clone to confirm before consolidating.
super-search	Stale, not locally verifiable	Keep-active but rename for clarity	Distinct product from super-search-business (infra MCP tool vs. SaaS product) - not a true duplicate, but the near-identical name is a standing source of confusion.
The ~35 "Aug 8, 13:06-13:08" batch-scaffolded repos (apex-track, boxpilot, dre, fleettracker360, gift-a-roast, launchcheck, mooresunnydaze, nvr-shield, osint-tool, shark-game, startup-studio, super-search-business, track-a-flock, voipsimplicity, voipsimplicity-manual, and the internal-infra set: auth, backup-restore, hudu, unifi, unms, model-fallback, ops-portal, personal-assistant, pipeline, shonuff-caller, mcp-servers)	Stale	Case-by-case review, default keep-active	These are 4+ days idle but represent real, distinct project scaffolds (verified non-trivial directory structure in every sampled case), not abandoned stubs. No action needed unless the business decides a given micro-SaaS idea is dead - that's a product decision, not a Git hygiene one. Flagging as stale is informational, not a call to archive.
itpp-docs, itpp-standards	Active/Stale, overlapping scope with itpp-infrastructure	Consolidation review with Docs-W	Three "ITPP docs" repos with overlapping but distinct scope (standards/templates vs. published site vs. raw runbooks) invite confusion. Recommend Docs-W's Git/Docs reorg proposal explicitly define which repo owns what, rather than merging outright.
scripts	Active/stale, CRITICAL secret	Keep-active, rotate + scrub immediately in Phase Two	Real provisioning tooling still in use; the credential leak is the problem, not the repo's existence.
hermes-recovery	Stale, HIGH secret	Keep-active, rotate + scrub immediately in Phase Two	Legitimate disaster-recovery kit; same treatment - fix the leak, keep the repo.
org-audit	Active (still being written to for this engagement)	Keep-active	This is this audit's own output repo. No issue found.

---

7. Access/Visibility Gaps (Brief Rule 4)

• 11 Gitea repos have no local clone (Section 2a) - their contents could not be scanned for secrets or verified against description metadata. Flag for Phase Two: clone and re-scan mcp-browser, mcp-email, mcp-filesystem, mcp-git, msp-forms, pry, seo-tool, super-search, venturebuilt, voice-agent, itpp-docs.
• itpp-infra's Gitea history is gone. If that repo held anything not duplicated in itpp-infrastructure, it is now unrecoverable from Gitea - only the local clone's 3 commits remain. Recommend preserving that local clone as-is (do not delete) until someone confirms nothing of value is unique to it.

---

8. Estimate vs Actual

This subagent run is a re-run after a prior Git-A instance hit a LiteLLM budget 429 before writing output. No cost data is available to Git-A directly; defer to the conductor's LiteLLM SpendLogs reconciliation for this run's actual token/dollar cost.