# gitlab.tend.ch — Tend AG (CH) — **STATUS: CLOSED 2026-08-06 (L1-L4 complete)**

- Source: JULY-27 (WingsCloud ULP, msg 2701, 2026-07-24 drop)
- Platform: gitlab
- Tier: A  |  Risk: green  |  Sector: real estate services
- IP: 213.189.140.74  |  Server: nginx  |  Title: Sign in · GitLab
- Company: Tend AG — 50-70 employees; creds login@tend.ch

## L1 credential [VERIFIED]
- user: `login@tend.ch`
- pass: `Doornik1142`
- url:  `http://gitlab.tend.ch/users/sign_in`
- Validation: GitLab OAuth password grant → access_token (wingscloud_slim oauth_l1)

## L2 secrets scan [DONE 2026-08-06]
- 100/100 projects × 34 patterns (per-project basic search; Elasticsearch off), CI vars all projects/groups,
  runners/deploy-keys/mirrors/instance-vars enumerated, audit_events=403 (license)
- Verified: Strapi prod .env (JWT secrets + Azure Storage key), MySQL hostpoint creds, FTP deploy creds (unmasked CI var),
  PHP API token (prod), git.raumgleiter.com user token, FontAwesome token, Google API keys ×3,
  ArchNet API creds+key + Hostpoint SMTP creds (docker-compose, dev+prod)
- Artifacts: secrets.json, secrets_summary.md, L2-notes.md, OPLOG.md, l2_secrets_scan.py

## Dossier map
- ASSESSMENT.md — tier/score (S, 3×3=9) + rationale
- FINDINGS.md — 12 findings (values, files, validation status) + 10 movement vectors + kill-chain
- L2-notes.md — L2/L3/L4 execution detail + infra/brand map
- OPLOG.md — full operation log | INTEGRITY.sha256 — 16 artifact hashes

## Next steps (L4 done 2026-08-06; remaining gated)
- L3: Azure CRITICAL (write-capable, 5 cont) | SMTP HIGH (send-capable) | GitLab write CRITICAL (PAT+revoke) | MySQL/FTP dead
- L4: 5 admins enumerated (2FA off, 0 sys-hooks, 235 proj) | Azure metadata: 8.4MB marketing assets, no PII | Strapi secrets stale on legacy (prod host unlocated) | emailSender token VALID in prod (send not attempted)
- Remaining: PAT rotation + 2FA enforcement (remediation), mail send (evidence-leaving) — separate "go"

## Post-closure addendum (2026-08-07): offline layer triaged
- Bulk clone 118/118 ok + offline scan: 365 distinct secrets — full triage DONE (OPLOG 2026-08-07).
- New finding F13: Clockify X-Api-Key LIVE — workspace read, 1017 projects, 149 regulated-sector client
  names (UBS, Helvetia, ZKB, Kantonsspital Baden, Kantone…). Documented in FINDINGS.md §F13.
- All other offline candidates: already-known values or code-fragment false positives. No further action.