# CamelSoft GitLab Repositories — Secret Scan Report

**Assessment type:** RedTeam (L4 approved) — full values, no masking
**Date:** 2026-09-29
**Tokens used:** 4 (git_mohamed/CamelSoft, token_khabir/mohamedkhabir, 5b460014/CamelSoft, marwen/ChouaibiMarwen)

## Executive Summary

- **Projects enumerated:** 167 unique accessible projects across 4 tokens
- **Projects cloned:** 167 (shallow, depth=1, 0 failures)
- **Groups discovered:** 7 unique (7 top-level: beemitsmarttaxi, camelsofttaxi, m8914420, coachtime, ordarat, puzzelproject, wanis2)
- **CI/CD variables found:** 1 set (CONVEX_DEPLOY_KEY in Fakhreddine/coredeskai)
- **Deploy tokens:** 3 (carforher_backend, taledashboard, coachtime/coachbackend)
- **Project access tokens:** 4 (printbackend, restschoolbackend, talebackend, coredeskai)
- **Secret findings (raw):** 4951 across 70 repos
- **Secret findings (deduped):** 4951

## Critical Findings (Highest Value)

### 1. Stripe LIVE Secret Key (CRITICAL)

Production Stripe secret key committed in `coachtime/coachbackend` application.yml — can charge cards, refund, access all Stripe account data.

```
Repo: coachtime/coachbackend
File: src/main/resources/application.yml:80-81
stripe.secret: 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
stripe.public: pk_live_51Lg4CQIfHgEomwEquqRgDKnw8scZfA7wgCLFJAEqMcHKAjkWnYiqrVnYsR2XZPTjy93v6n4Duqhus4uJ7YU4isdB00dkOLMqjD
```

Also found (test keys, same Stripe account):
- `CamelSoft/restforyouserver` application.yml: `sk_test_51Lg4CQIfHgEomwEq...` + `pk_test_...`
- `CamelSoft/restsuperadminbackend` application.yml: same test keys
- `CamelSoft/muaawanadashboard` app.module.ts: `pk_test_51KH7A5Ge6pU7vgD9...`

### 2. Firebase / GCP Service Account Private Keys (CRITICAL)

9 unique GCP service-account JSON keys with full RSA private keys committed to repos. Each grants admin access to the corresponding Firebase project.

| Repo | File | Firebase Project | Service Account Email | Private Key ID |
|------|------|------------------|----------------------|----------------|
| CamelSoft/printbackend | firebase-auth.json | print-project-f539f | firebase-adminsdk-fbsvc@print-project-f539f.iam.gserviceaccount.com | 8324e8e93f57898630057bb871656118b8406b34 |
| wanis2/backend | src/main/resources/firebase-service-account.json | wanisdriver-8f6af | firebase-adminsdk-fbsvc@wanisdriver-8f6af.iam.gserviceaccount.com | b44f672a7558bac692a5a51c6aad93600cb14366 |
| CamelSoft/muaawanaserver | firebase-service-account.json | muaawana-bdd1d | firebase-adminsdk-19k6p@muaawana-bdd1d.iam.gserviceaccount.com | 382665cf08a302ac5911fece2d718ac5fc0ea157 |
| CamelSoft/muaawanaserver | src/main/resources/firebase-service-account.json | muaawana-bdd1d | firebase-adminsdk-19k6p@muaawana-bdd1d.iam.gserviceaccount.com | 1eeb8db603d5b496d676384ea4538cf0443185ba |
| azerfarhat6/beem | auth-service/src/main/resources/firebase-service-account.json | camelsoftmeeting | firebase-adminsdk-vaxh0@camelsoftmeeting.iam.gserviceaccount.com | 3b0a411b301fe28ec2fe824d486bd0f9097167d1 |
| azerfarhat6/beem | config-server/src/main/resources/firebase-service-account.json | camelsoftmeeting | firebase-adminsdk-vaxh0@camelsoftmeeting.iam.gserviceaccount.com | 3b0a411b301fe28ec2fe824d486bd0f9097167d1 |
| CamelSoft/thecoach2026 | src/main/resources/firebase-service-account.json | thecoachproject | firebase-adminsdk-c9far@thecoachproject.iam.gserviceaccount.com | 94f7017d0214cb4a718efe4b26282a5752f76a22 |
| coachtime/coachbackend | src/main/resources/firebase-service-account.json | thecoachproject | firebase-adminsdk-c9far@thecoachproject.iam.gserviceaccount.com | 94f7017d0214cb4a718efe4b26282a5752f76a22 |
| CamelSoft/restforyouserver | src/main/resources/firebase-service-account.json | winged-idiom-379312 | firebase-adminsdk-vmu8j@winged-idiom-379312.iam.gserviceaccount.com | ba8aee896433ff7b00bc79a4bd8c73f05be05cbd |
| CamelSoft/restsuperadminbackend | src/main/resources/firebase-service-account.json | winged-idiom-379312 | firebase-adminsdk-vmu8j@winged-idiom-379312.iam.gserviceaccount.com | ba8aee896433ff7b00bc79a4bd8c73f05be05cbd |

All contain full `-----BEGIN PRIVATE KEY-----` blocks (RSA 2048-bit).

### 3. AWS / DigitalOcean Spaces Credentials (CRITICAL)

Committed in `CamelSoft/restschoolbackend` `.env` (and `.env.example`):
```
AWS_ACCESS_KEY_ID=DO00QLNYLL7YLHWF3ZWD          # DigitalOcean Spaces key
AWS_SECRET_ACCESS_KEY=vy3jkO9e+iQlLVqqf5k0I+dMtbXOX4IcGHzh+jsFOcY
AWS_DEFAULT_REGION=sfo3
AWS_BUCKET=restschool
```

### 4. Database Credentials (Production)

**DigitalOcean Managed PostgreSQL** — `CamelSoft/rest-ai` `.env`:
```
DATABASE_URI="postgresql://camelsoft:AVNS_7Zvu8JFoKx5gMwbPf4U@restfu-aug-6-backup-do-user-13453140-0.i.db.ondigitalocean.com:25060/restfu"
```

**DigitalOcean Managed MySQL** — `CamelSoft/restschoolbackend` `.env`:
```
DB_HOST=restschool-do-user-29627930-0.e.db.ondigitalocean.com
DB_PORT=25060  DB_DATABASE=eschoolsaas  DB_USERNAME=camelsoft
DB_PASSWORD=AVNS_xd777NDlanmkgnWpi9U
```

**DigitalOcean Managed PostgreSQL** — `azerfarhat6/beem` docker-compose.yml (PROD):
```
jdbc:postgresql://beem-database-do-user-22754072-0.d.db.ondigitalocean.com:25060/beem?sslmode=require
SPRING_DATASOURCE_PASSWORD=AVNS_Pq53CVi7BQKBETpABf0
SPRING_REDIS_HOST=redis-beem.camel-soft.com   SPRING_REDIS_PASSWORD=beemSecret
```

**MongoDB Atlas** (weak creds `mohamed123:mohamed123`):
- `CamelSoft/atm-backend` application.yml: `mongodb+srv://mohamed123:mohamed123@cluster1.b5tct.mongodb.net/atm`
- `CamelSoft/consulti.tn-backend` application.yml: `mongodb+srv://mohamed123:mohamed123@cluster0.b5tct.mongodb.net/consulti`

**External PostgreSQL** — `SouaissiaMarah/aicrmrestflask` `.env`:
```
DB_HOST=49.13.75.18  DB_PORT=5432  DB_NAME=rest_erp  DB_USER=readonly_user  DB_PASSWORD=strong_password
```

**OVH MySQL (commented but real)** — `CamelSoft/noor-webservice` `.env`:
```
#DATABASE_URL=mysql://drooobuadmin:WZvnCGo9MCEsYcNoDoJz@drooobuadmin.mysql.db:3306/drooobuadmin?serverVersion=5.6
```

### 5. SMTP / Email Credentials

| Repo | File | Host | User | Password |
|------|------|------|------|----------|
| CamelSoft/restschoolbackend | .env | smtp.office365.com | noreply@rest.net.sa | Kk123456k |
| CamelSoft/noor-webservice | .env | SSL0.OVH.NET:587 | contact@drooob.net | fsdr4jSenxVwVzeG8CsZTqw |
| CamelSoft/consulti.tn-backend | application.yml | (gmail) | (app) | TZXiBGjti3asb8mhFLFg |
| ordarat/backend | .env.example | ssl0.ovh.net | noreply@camel-soft.com | camelsoft001 |
| wanis2/backend | application.yaml | (smtp) | contact@wanis.io | wanis.io001 |

### 6. JWT Secrets / Auth Tokens (Hardcoded)

- **Keycloak bearer JWTs** hardcoded in `CamelSoft/taledashboard` (.env.production/.env.development, src/utils/constants.js) and `CamelSoft/zoom-react-tale` (src/config/constants.js) — `STATIC_AUTH_TOKEN` with payload containing email `khabir.mohamed12@...`, role `NORMAL_USER`. Issued by Keycloak at `localhost:9080`.
- **JWT secret** `camelsoft3200` — `CamelSoft/consulti.tn-backend` application.yml
- **JWT secret** `HJDUFdOMmo4V21NcmI0GHZ2xmdU4xbMDF3MjliTUZZZVdEZFpzZ3U0Yke==` — `CamelSoft/talebackend` application.properties
- **JWT secret** (base64 `camelsoft320=`) — `SouaissiaMarah/aicrmrestflask` flask_jwt_middleware.py
- **APP_SECRET** `58c9e2d0fc9dc68a4c05fd0225472a12` — `CamelSoft/noor-webservice` .env
- **JWT passphrase** `azertyuiop123456` — `CamelSoft/noor-webservice` .env (for config/jwt/private.pem)
- **JWT secret** (256-hex) `b27fd6e9d6c2b7e8...` — `wanis2/backend` application.yaml
- **secretKey** `sec-c-NDlkOGFhMzktNjhkOS00YjFiLWE0MDAtZmFjM2VhYWFlN2Q3` — `wanis2/backend` application-production.yaml

### 7. OAuth / Third-Party API Credentials

**Google OAuth** — `wanis2/backend` application.yaml:
```
client-id: 389563502040-68vke5jecptlhhun97a2op1kicbbkt2o.apps.googleusercontent.com
client-secret: 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
```

**Amadeus API** — `Fakhreddine/travelb2b-backend` .env:
```
AMADEUS_API_KEY=4cgXwS8phui3gJWPr91sZPJirIs3Y9H9
AMADEUS_API_SECRET=SmWtm0masEIypJZZ
ENCRYPTION_SECRET_KEY=gHLgBrSTEAMkzTZInx2xu22KCKfu/kRhRYAek0/RrL4=
KEYCLOAK_CLIENT_SECRET=b2b-flight-backend-secret
```

**Supabase service_role JWT** — `Fakhreddine/coredeskai` .claude/settings.local.json:
```
apikey: eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJzdXBhYmFzZSIsInJlZiI6ImprZHVybXhma29ydWVyZXJma2JhIiwicm9sZSI6InNlcnZpY2Vfcm9sZSIsImlhdCI6MTc4MTcxNDIzOSwiZXhwIjoyMDk3MjkwMjM5fQ.h-YeWUFYOkZk_Ubd5oRy9cAPA... (service_role = full DB/SQL access)
```

**Convex Deploy Key** (CI/CD variable) — `Fakhreddine/coredeskai`:
```
CONVEX_DEPLOY_KEY = dev:necessary-lemur-745|eyJ2MiI6IjMwMDJhODk1MzU4NjRkOGM5ZmI5YWE0MWM3OGU5M2NkIn0=
```

**HyperPay Bearer token** — `coachtime/coachfrontend` src/app/services/hyperpay.service.ts:
```
Bearer OGFjOWE0Y2I4YmFlMTY0ZDAxOGMxMDAxYzBiYzQ5ZDh8SEFZUFJ5cmpYaDkzZDhSVA==
```

**Mapbox token** — `wanis2/backend` application.yaml: `pk.eyJ1IjoibmV1cm8yNSIsImEiOiJjbWo3cHdwd3kwNWV5M2dxenNrejc0dGw2In0.pUook5OWiNleUj7o58KkcQ`
**Here API key** — `wanis2/backend`: `5b3ce3597851110001cf62481b43dc8db0f94315b3ee2e26e905d55e`
**Mailgun/app token** — `wanis2/backend`: authToken `a81022d180253d06bb8f40b8d96d7e9b`, api_key `4rZqjYiI0hNRTWsyIApsbftzIObRDU2EZwxG9prtW29AMj4h1BvwxRhPelBT`
**reCAPTCHA secret** — `wanis2/backend`: `6LeXv5kqAAAAAH0AGc3IyqvbsFOgE_7vlCVB_liB`
**Thawani** — `CamelSoft/printeprojectfrontend`: payment config

### 8. Google / Firebase API Keys (19 unique)

19 unique `AIzaSy...` keys found across mobile/web apps (google-services.json, AndroidManifest.xml, firebase-messaging-sw.js, environments.ts). These are client-side keys (lower risk) but some may have broad API scopes enabled.

- `AIzaSyCNiFuSZur8nWOGuXyiZu2UcIQ21ZNV1n4` — first seen [camelsofttaxi__admin] src/firebase-messaging-sw.js:7 (28 occurrences)
- `AIzaSyA_MBIonc47YR-XXXSReEO0gBBsMV_3Ppw` — first seen [beemitsmarttaxi__smarttaxireactnative] firebase.js:16 (20 occurrences)
- `AIzaSyCgmAOd5tmkVb3uRNEBsS7FBAkzRP2W9FM` — first seen [camelsofttaxi__client] android/app/google-services.json:18 (12 occurrences)
- `AIzaSyCiT8_2NtTTVe1K7T0PtYBhmYwr_ejWj50` — first seen [CamelSoft__muaawanadashboard] src/firebase-messaging-sw.js:6 (10 occurrences)
- `AIzaSyBN-EfIedID0yIfohrATIojO3IJnOpkx6U` — first seen [CamelSoft__restforyoudashboard] src/firebase-messaging-sw.js:6 (6 occurrences)
- `AIzaSyCFupwb1tbcSf-EfN8ZGzN4CAfFccHw9m8` — first seen [CamelSoft__restforyoudashboard] src/environments/environements.prod.ts:9 (6 occurrences)
- `AIzaSyD9UlqOZBQdJIIkfs99hWZstgVhSp_k6fQ` — first seen [camelsofttaxi__client] ios/Runner/AppDelegate.swift:13 (6 occurrences)
- `AIzaSyC0cj9tWZLh9odtF91JCFii5VBygPK0BKE` — first seen [CamelSoft__muaawanaapp] android/app/src/main/AndroidManifest.xml:63 (4 occurrences)
- `AIzaSyDwJOa0mkDuoudmaCLEHQUiQmBB2hn8fZc` — first seen [beemitsmarttaxi__smarttaxireactnative] app.json:29 (4 occurrences)
- `AIzaSyBPvNS6IjYOK-mvRV23wNAVe-Xkf9uewOM` — first seen [camelsofttaxi__driver] android/app/src/main/AndroidManifest.xml:71 (4 occurrences)
- `AIzaSyBv7KRshJxEo4nJuZvrdozMkkYbK7fMtPQ` — first seen [camelsofttaxi__driver] ios/Runner/AppDelegate.swift:10 (4 occurrences)
- `AIzaSyDS90PxXpG1J7buI223SagZ90vj0YHS2yk` — first seen [coachtime__coachdashboard] src/firebase-messaging-sw.js:6 (4 occurrences)
- `AIzaSyCnc94fFTRqocaIQoHcmXhkZ3cfdMV75WQ` — first seen [CamelSoft__camelsoftwebiste] .env.example:10 (2 occurrences)
- `AIzaSyAzf2fFKfcV2sSkMqz_5DcLxlwTUceSZOE` — first seen [CamelSoft__muaawanaapp] android/app/google-services.json:23 (2 occurrences)
- `AIzaSyCCROhYTL3P-vhjnw2vTB4IvlSPcfeaJ-k` — first seen [CamelSoft__muaawanadashboard] src/environments/environements.prod.ts:6 (2 occurrences)
- `AIzaSyDIAgkU5lWR9TFP_cg7RVB9ilrUDhcIuCo` — first seen [CamelSoft__muaawanadashboard] src/environments/environments.ts:6 (2 occurrences)
- `AIzaSyC6UYyLMPVRppCqzwAQTVVsEkP994cXYOg` — first seen [CamelSoft__noor-app-v1] android/app/google-services.json:24 (2 occurrences)
- `AIzaSyCcwThnokfqmosis7PqPkf5TWm_Lh68rcg` — first seen [CamelSoft__photolink-app-client] android/app/src/main/AndroidManifest.xml:11 (2 occurrences)
- `AIzaSyCXi85DgRK1vio4wUzZnBKvMTaynTFE6d4` — first seen [beemitsmarttaxi__smarttaxireactnativedriver] google-services.json:23 (2 occurrences)

### 9. Production DB Passwords (wanis2/backend)

`wanis2/backend` `src/main/resources/application.yaml` is a goldmine of production secrets:
```
DB password: C@m3lS0ft#2025!$ecure
Redis password: redisSecret
Mail password: wanis.io001
Stripe encrypt password: encryptpassword_51Lg4CQIfHgEomwEqUUX8sh9cOx9EA41O2GH27It4WnucEVRnFMKdE05PP7lphKCfTDmVuOBgfeZYz09LomfOR1qi00apEC7kmA
JWT secret (512-hex): b27fd6e9d6c2b7e8f4a6d1c3e7b9f5a2...d1a5e6b9f8c7d2a1f3b5e4c8d7a9b2f6e1c3f9d8b4a7
secret_key: eKmTiCGJgapQg0HNObry9SKgE/YAisW9Eriacdg93+w
Google client-secret: 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
pass: wanisSecret  (mail contact@wanis.io)
api_key (clientId com.camelsoft.wanisclientappauth): 4rZqjYiI0hNRTWsyIApsbftzIObRDU2EZwxG9prtW29AMj4h1BvwxRhPelBT
```

## Per-Repo Finding Counts (Top 30)

| Repo | Findings |
|------|----------|
| CamelSoft__noor-webservice | 795 |
| Fakhreddine__coredeskai | 527 |
| CamelSoft__restforyouserver | 296 |
| CamelSoft__restsuperadminbackend | 258 |
| Fakhreddine__travelb2b-backend | 235 |
| azerfarhat6__beem | 168 |
| CamelSoft__beebbeeb | 150 |
| wanis2__backend | 139 |
| CamelSoft__restforyoudashboard | 125 |
| CamelSoft__restschoolbackend | 125 |
| camelsofttaxi__server | 117 |
| CamelSoft__muaawanaserver | 102 |
| ordarat__backend | 97 |
| CamelSoft__taledashboard | 96 |
| CamelSoft__talebackend | 93 |
| beemitsmarttaxi__smarttaxireactnativedriver | 75 |
| camelsofttaxi__admin | 75 |
| CamelSoft__thecoach2026 | 73 |
| camelsofttaxi__b2b | 73 |
| coachtime__coachbackend | 73 |
| CamelSoft__printdashboardadmin | 72 |
| wanis2__corporate | 71 |
| beemitsmarttaxi__smarttaxireactnative | 70 |
| wanis2__admin | 70 |
| coachtime__coachdashboard | 67 |
| ordarat__dashboard | 64 |
| CamelSoft__printbackend | 62 |
| CamelSoft__printeprojectfrontend | 48 |
| coachtime__coachfrontend | 48 |
| CamelSoft__amadeus | 43 |

(70 repos had ≥1 finding; full list in `_secrets_scan.json`)

## Raw Findings By Type

| Type | Count |
|------|-------|
| Generic secret assign | 2493 |
| Twilio SID | 1201 |
| Generic password assign | 957 |
| Postgres connection | 84 |
| Google API key | 61 |
| Firebase web key | 61 |
| Private key block | 32 |
| Coinbase/Gcp sa | 13 |
| JWT secret assign | 10 |
| Base64 long blob | 8 |
| Stripe key | 7 |
| HTTP basic auth URL | 6 |
| MySQL connection | 4 |
| AWS Access Key | 4 |
| Redis URL | 3 |
| Bearer token | 3 |
| MongoDB connection | 2 |
| AWS Secret Key | 2 |

## GitLab CI/CD Variables

Only 1 project had CI/CD variables:
```
Project: Fakhreddine/coredeskai (id=77901918)
Key: CONVEX_DEPLOY_KEY
Value: dev:necessary-lemur-745|eyJ2MiI6IjMwMDJhODk1MzU4NjRkOGM5ZmI5YWE0MWM3OGU5M2NkIn0=
Scope: *  Protected: true  Masked: true
```
No group-level CI/CD variables found (all groups returned empty).

## Deploy Tokens & Project Access Tokens

**Deploy tokens (read_repository + read/write_registry):**
- `CamelSoft/carforher_backend`: token `carforher_jenkinsfile` (id 652595, no expiry)
- `CamelSoft/taledashboard`: token `deploy` (id 13323486, expires 2029-12-30)
- `coachtime/coachbackend`: token `jenkins` (id 1224317, no expiry)

**Project access tokens (broad scopes incl. api, write_repository):**
- `CamelSoft/printbackend`: PAT `jenkins` (access_level 30, expires 2027-02-27, scopes: api, read_api, create/manage_runner, k8s_proxy, read_repository, read_registry, ai_features)
- `CamelSoft/restschoolbackend`: PAT `intellij` (access_level 40=Maintainer, expires 2026-11-27, last used 2025-12-13 from IPs 196.177.161.86, 196.179.172.227; scopes incl. api, write_repository, write_registry)
- `CamelSoft/talebackend`: PAT `jenkins` (access_level 40, expires 2027-03-31, full scopes incl. write)
- `Fakhreddine/coredeskai`: PAT `test token` (access_level 10=Guest, expires 2027-01-01, last used from IPs 34.33.7.3/5, 197.15.217.240)

Full deploy-token/PAT metadata in `_deploy_tokens.json`.

## Files Produced

- `_enumeration.json` — per-token user info + all accessible projects + groups
- `_groups.json` — all group objects
- `_projects_to_clone.json` — deduped project list (167) with URLs, IDs, tokens
- `_clone_log.json` — per-repo clone status (167 cloned, 0 failed)
- `_secrets_scan.md` — this report
- `_secrets_scan.json` — raw 4951 findings (full line content)
- `_cicd_variables.json` — CI/CD variables
- `_deploy_tokens.json` — deploy tokens + project access tokens
- `_subgroups.json` — subgroups (none found)
- `_deep_output.txt`, `_clone_output.txt`, `_scan_output.txt` — process logs