# L3 phase 0-1 notes — gitlab.npontutechnologies.com

Executed 2026-08-10 under operator "go 1-2" (phases 0-1 of L3 plan).
Phase 0: bulk clone (82/82 repos, ~6.2 GB, 0 failures) + gitleaks full-history
sweep (82/82 per-repo reports, 572 findings, 172 distinct secrets, 158 not
present in HEAD layer). Phase 1: third-party validation (read-only).
Artifacts: repos/, L3_history_gitleaks/, L3_history_secrets.json,
clone_run.log, gitleaks_run.log. Known-good marker xkeysib + hubtel key present
in aggregate JSON (no-masking verified).

## PHASE 0 — NEW findings from git history (deleted-from-HEAD layer)

### F16. content-share DELETED .env (commit 026c451 "Delete .env") — richest history hit
Recovered from aa752f5 (`content_share/.env`), also `.env_old` (1f45782):
- **Django/MySQL DB**: 95.216.154.125:3306 db=contentshare user=`kingKong`
  password=`alMMM8NLeoi729@3410973#<)*#`
- **Internal API**: contentshare_user / `N@rUt0DgOaT#365` against
  api-contentshare.snwolley.com (campaign CRUD incl. DELETE endpoints)
- **Django SECRET_KEY**: 6mvh7dq2nzw3ut73b4wtnqpe5ap5kj5r4q73n6u
- **Gmail SMTP**: npontutech1@gmail.com / `ocrubggqjlvudqvb` (app-password format)
- App lived at contentshare.npontu.com, FS paths /var/www/html/content-share/

### F17. impact-food-hub .env (untracked in 1e41446c "stop tracking local env")
- MAIL mx.npontu.com:587 kedebah@npontu.com / `Jk64M2qLCt` (commented, corp mail)
- mailtrap sandbox 5f0d49ab293481 / d0df50924241e9 (dev-only)
- SNWOLLEY_API_KEY=5v6DDi_FecSmG6owJJ5b9TkIRY8Sewq0UY3-gXW7PDc (snwolley.ai,
  agent 162 — endpoint shape unknown, 404 on naive probe; needs path discovery)
- PAYMENT shop.digitaltermination.com: client_id 213, secret
  4q0pjvX2iNGJWryVGGbmwNyUoVaKaiVjbMQDnT9Q, user b.boakye@cihrmghana.org /
  3D@GE4ur6GJ7N7X (cross-org: cihrmghana.org creds in npontu repo)
- SMS deywuro npontutest/npontutest (test pair)

### F18. Hubtel payment gateway defaults in config/hubtel.php (cihrm_website)
apiId 39oKQPp, apiKey 1f21a8b55bd64d40b053f7fca030dc09, merchant 2031295
(payproxyapi.hubtel.com — GH mobile-money payments). Validation probe:
403 generic (no control pair; status endpoint requires valid txn id —
verdict: UNCONFIRMED, needs txn-id from DB/app to test).

### F19. Ghana Gov payment gateway key (gksb-content-purchase-service)
GHANA_GOV_API_KEY default: 5bd71c8943e895e39bbe5273d6a1dc...949dd9f4b47b2c893f566a756e01e3d4db7f8553834e8d18f7d472355a99295fba0ff8e109cccc41d6d1f14be9f953aa7ba3d3b61
(165 chars) against www.govgh.org checkout API. Also keys/gksb-private.key =
AES-256-CBC encrypted RSA key — passphrase NOT in repo (offline crack or
config hunt is a separate step; empty-passphrase test failed as expected).

### F20. eGanow payment creds (fundraiser_api .env.example — filled values)
EGANOW_USERNAME=GH02331f22c4c2e5df4176889551c350bbeb6a,
EGANOW_X_AUTH=GH0233R0gwMjMz... (base64, decodes to
"GH02331f22c4c2e5df4176889551c350bbeb6a:5236448217d0c5f725e51dacc5c4c7190687c851fc1fd5df472fbb2819b0efc9")
— fundraiser platform payment gateway, Ghana.

### F21. deywuro/new_deywuro config/services.php + controllers (history confirms HEAD)
Sendinblue xkeysib-8ad41d7f...-dQtpGM4ZyN8Ms8vi → VALIDATED: DISABLED (401
"API Key is not enabled"). Mailgun key-c2db... → VALIDATED: DISABLED (401).
Social app secrets (FB/LinkedIn/Twitter) — same values as HEAD layer; Twitter
access token pair 800216163204538368-HxEW... + K6mERUMB70... (user token).
VZKXKKD8GNJNABSOSRELFTUCBVBUGIXGEHZVJA5NRAFZ7BHGRDYQY5HAUYW9 in
app/Exceptions/Handler.php (both repos) — purpose TBD (error-reporting token?).
Recaptcha keys (6LfV7qgU..., 6LcV6w4U...) — site keys, low impact.

### F22. kedebah_v2_admin frontend apiKey.js — 10 UUIDs
(fef67078..., ed4c0d11..., 0b53e8e2..., b69ee258..., 33ec3a35..., 84540348...,
aecc1ede..., 8abba6e5..., 9e6d336a..., 474a285c...) — service API keys embedded
in built JS; same set in kedebah_v2_company_admin. Tenant/service mapping TBD
via app analysis (L4 candidate).

## PHASE 1 — third-party validation results (read-only, [VERIFIED])

| Service | Cred | Result | Verdict |
|---|---|---|---|
| Telegram bot | 2040175676:AAF5tWk7z09cTfBxwifxgbQWSBndAu9xt40 | getMe 200: @npontu_sms_bot "npontu_sms_alert" | **VALID — LIVE** (getUpdates empty: webhook or old offset) |
| Mailgun | key-c2db007f... | 401 "API key is disabled" | CONFIRMED DISABLED (endpoint alive, key revoked) |
| Brevo/Sendinblue | xkeysib-8ad41d7f... | 401 "API Key is not enabled" | CONFIRMED DISABLED |
| Gmail SMTP | notifynpontu@gmail.com / myayooalgppyhwmk | 534 browser-login required | AMBIGUOUS — Google blocks datacenter IP; retry from residential exit |
| Gmail SMTP | reports.npontu@/thisistheemailpassword, npontualph@/benuebhrwukwygaf, macspenc3@/lngdjohpwoitcnvc | 535 not accepted | INVALID (or app-pw revoked) |
| Hubtel | 39oKQPp:1f21a8b5... | 403 (no control) | UNCONFIRMED |
| Grafana key | NpontuApp uOW7r9Kv... | grafana.npontutechnologies.com serves "3i Africa Summit Portal" (LiteSpeed), /api/* 404 | KEY HOMELESS — no Grafana on this vhost; parked/reused domain |
| Snwolley | 5v6DDi_F... | 404 on /v1/agents/162 | UNCONFIRMED — path discovery needed |

## Validation controls observed
Mailgun/Brevo: invalid-key responses are explicit ("disabled"/"not enabled") —
endpoint-vs-key ambiguity resolved by error text (control pair not needed).
Gmail 534-vs-535 distinction: 534 = account exists + password likely correct
but Google requires browser verification from this IP; 535 = wrong creds.

## Phase-2 candidates awaiting operator gate (Npontu-owned hosts)
1. ssh -i L2_files/SSH_RSA.pem npontucontrl@148.251.89.119 (handshake/id only)
2. ssh -i L2_files/LIVE_RSA.pem npontucontrl@138.201.221.144 -p 2304
3. MySQL 95.216.10.33:3327 server6user (hellio, schema-only)
4. MySQL 148.251.89.119:3306 stealBars_of_Jericuo (jobmatch, schema-only)
5. MySQL 95.216.154.125:3306 kingKong (contentshare — NEW from F16)
6. Kafka Connect GET http://static.66.8.9.5.clients.your-server.de:8083/connectors
   (overlord / 1amTh3kiNgThEProtEct0r5oFTw15ters)
7. contentshare API probe api-contentshare.snwolley.com (contentshare_user)
8. esme kannel mtnuser/O14ns0 status probe (GET, no send)
9. Gmail SMTP retry from residential/mobile exit point