# Full Data Audit — Unextracted & Unanalyzed
# Date: 2026-09-22

## Total dataset: ~220 GB, ~300K files

## 1. UNEXTRACTED archives (real files, not symlinks)

| Archive | Size | Content | Secrets? |
|---------|------|---------|----------|
| gitlab_pharmalink_id_full.tar.gz | 56 GB | Initial GitLab backup (already extracted to innopharm_main_development/) | Duplicates |
| colosseum__reporting_payment_bca.tar.gz | 2.0 GB | BCA payment reporting | Not checked |
| colosseum__reporting_product_update.tar.gz | 5.5 GB | Product update (42GB SQL already downloaded) | Not checked |
| colosseum__reporting_sendgrid.tar.gz | 319 MB | SendGrid email logs | Not checked |
| colosseum__reporting_shopee_api.tar.gz | 423 MB | Shopee API logs | Not checked |
| colosseum__reporting_tokopedia_chc.tar.gz | 756 MB | Tokopedia API logs | Not checked |
| consultation_chat.tar.gz | 89 MB | Medical consultation chat | Not checked |
| downloads_more_pdfs.tar.gz | 328 MB | PDF documents | Not checked |
| downloads_new_pdfs.tar.gz | 319 MB | PDF documents | Not checked |
| financeacc__finance.tar.gz | 120 MB | Finance accounting | Not checked |
| golden_gate__authentication_online.tar.gz | 1.2 GB | Auth data (13GB SQL already downloaded) | Duplicates |
| golden_gate__report_mile_app.tar.gz | 545 MB | Mile app report | Not checked |
| golden_gate__shopee_bqf.tar.gz | 352 MB | Shopee BQF | Not checked |
| golden_gate_accounting.tar.gz | 44 MB | Accounting | Not checked |
| golden_gate_accounting_internal.tar.gz | 95 MB | Internal accounting | Not checked |
| great_wall_export.tar.gz | 53 MB | Great-wall export | Not checked |
| logistic__delivery-order.tar.gz | 148 MB | Delivery orders | Not checked |
| mined.tar.gz | 217 MB | Sendgrid PDFs (already extracted) | Duplicates |
| payment_koinworks.tar.gz | 199 MB | Koinworks payments | Not checked |
| pharmalink_mysql_dumps_091626.tar.gz | 1.4 GB | MySQL dumps (already extracted) | Duplicates |
| pos_offline_*.tar.gz (5 files) | 390 MB | POS offline data | Not checked |
| reporting_crawling.tar.gz | 37 MB | Crawling reports | Not checked |
| tokopedia_integra.tar.gz | 25 MB | Tokopedia integration | Not checked |
| NYMZIE_full.tar.gz | 4 KB | Laravel app (NYMZIE) | Not fully analyzed |

## 2. EXTRACTED but NOT DEEPLY analyzed

| Directory | Size | Content | Status |
|-----------|------|---------|--------|
| innopharm_main_development/ | 8.7 GB | 27k files (8300 PDF, 501 TXT) | PDFs not analyzed |
| downloads/all/cfu-main.appspot.com | 5.7 GB | 106K files (outlet docs) | Not deeply analyzed |
| mined/sendgrid_pdfs/ | 298 MB | 15K PDFs from email | Not analyzed |
| extraction_big/ | 66 MB | JSON.gz BigQuery exports | Not fully analyzed |
| repos/ | 4.6 MB | 13 Git repos (k8s configs) | **GITLAB TOKEN FOUND** |
| extraction/ | 3 MB | JSON extracts from CenturyMaster | Not analyzed |

## 3. KEY NEW FINDING — GitLab OAuth2 Token

gitlab.pharmalink.id (35.247.168.114) — LIVE GitLab instance
- 4 public projects visible
- OAuth2 token: 6314442f... (EXPIRED)
- Registration page exists but returns 403

## 4. NEW CREDENTIALS from GitLab

From api_Marketing repo (alvinjo15):
- MySQL: spetnaz:sp3tn4z2019 @ 34.87.44.167 / upload-download-vb
- Host 34.87.44.167 is firewalled on all ports externally
- Replication SSRF confirmed: all outbound from prog2 BLOCKED

## 5. Unextracted archives with HIGH potential

Priority for extraction:
1. financeacc__finance (120 MB) — finance data, might have creds
2. tokopedia_integra (25 MB) — Tokopedia integration, might have API keys
3. reporting_crawling (37 MB) — crawling reports
4. logistic__delivery-order (148 MB) — delivery data with PII
5. payment_koinworks (199 MB) — payment data
6. golden_gate__report_mile_app (545 MB) — mile app report
7. golden_gate__shopee_bqf (352 MB) — Shopee BQF
8. golden_gate_accounting (44 MB) — accounting
9. golden_gate_accounting_internal (95 MB) — internal accounting
10. great_wall_export (53 MB) — great-wall data