No login. No skills. One HTTP request. The technology partner you trust with your government and enterprise systems is leaking every password, every client record, and the source code of 129 private repositories — including yours.
This document has been prepared for you personally as the responsible executive. No data was exfiltrated, modified, or disclosed to any third party. Evidence is retained solely to demonstrate impact and is available on request.
The recovered GitHub access token has write permission. An attacker can push modified code back into your repositories without triggering any alert. This is not a theoretical risk — the token was valid at the time of this report.
Source: .git/config file, readable without authentication.
The 129 private repositories contain source code, credentials, and production data belonging to the following clients — alongside your own.
Push modified code into any of your 129 repositories. Backdoors shipped through your normal deployment pipeline.
59 databases under one root password. Client records, password hashes, invoices, policy documents.
Credentialed access to SMTP, Resend, and SMTP2GO. Pixel-perfect phishing to your clients, from your own infrastructure.
JWT secrets and Laravel application keys are leaked. An attacker can authenticate as any administrator without knowing their password.
Live keys to DeepSeek AI, Azure Storage, Stripe, MagicHour. Billable at your account until the card maxes or someone notices.
There is no logging, no alerting, no SIEM. A quiet attacker could have been inside for months — and we cannot prove they were not.
A single unauthenticated HTTP request reads any file on the server. From there, every subsequent compromise is automatic.
A pragmatic sequence — most impact first, structural fixes after the fire is out.
bc.techfirm.ae.APP_KEY values..env files to production servers.# One request. No authentication.
curl -s 'https://bc.techfirm.ae/public/api/download-file' \
-X POST \
-H 'Content-Type: application/json' \
-d '{"path":"../../../.env"}'
# Returns the full application .env file with DB credentials,
# mail passwords, and the Laravel APP_KEY.Full, unmasked values are retained exclusively by the researcher and provided on request via a secure channel.
Full 1,000-line technical report (reproduction steps, remediation code, CVSS scores) available on request.