================================================================================
SIMULATED REPOSITORY DUMP — FOR CTF / EDUCATIONAL USE ONLY
All secrets in this file are completely fictional and non-functional.
================================================================================

--- FILE: .env (committed to repository root) ---

# Application Configuration
APP_NAME=InvoicePortal
APP_ENV=production
APP_DEBUG=true
APP_PORT=8080

# AWS Credentials
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7FAKE001
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKESECRET01
AWS_DEFAULT_REGION=us-east-1
AWS_S3_BUCKET=invoiceportal-prod-uploads

# Database
DATABASE_URL=postgresql://app_admin:Tr0ub4dor&3horse@prod-db.c9kfj2md.us-east-1.rds.amazonaws.com:5432/invoices_prod
REDIS_URL=redis://:p@ssw0rd_redis_2024@cache.internal.invoiceportal.io:6379/0

# Third-party API Keys
STRIPE_SECRET_KEY=sk_live_51HG4fAKEk3y00NOTREAL000000000000000000000000000
STRIPE_WEBHOOK_SECRET=whsec_FAKE1234567890abcdefghijklmnop
SENDGRID_API_KEY=SG.FAKE_KEY_abcdefghijklmnop.qrstuvwxyz1234567890ABCDEFGHIJ
TWILIO_AUTH_TOKEN=fake0auth0token012345678901234567

# Slack Integration
SLACK_WEBHOOK_URL=https://hooks.slack.com/services/T0FAKE01/B0FAKE02/fAkEwEbHoOkTokEn12345678
SLACK_BOT_TOKEN=xoxb-000000000000-0000000000000-FakeSlackBotToken123

# JWT
JWT_SECRET=my-super-secret-jwt-key-that-should-not-be-here-2024


--- FILE: config/database.yml ---

production:
  adapter: postgresql
  host: prod-db.c9kfj2md.us-east-1.rds.amazonaws.com
  port: 5432
  database: invoices_prod
  username: app_admin
  password: Tr0ub4dor&3horse
  pool: 25
  timeout: 5000

staging:
  adapter: postgresql
  host: staging-db.c9kfj2md.us-east-1.rds.amazonaws.com
  port: 5432
  database: invoices_staging
  username: staging_user
  password: StagingPa$$w0rd!2024
  pool: 10
  timeout: 5000


--- FILE: src/auth/jwt_handler.py ---

import jwt
import datetime

# TODO: move to environment variable
JWT_SECRET = "my-super-secret-jwt-key-that-should-not-be-here-2024"
JWT_ALGORITHM = "HS256"

def create_token(user_id, role):
    payload = {
        "sub": user_id,
        "role": role,
        "iat": datetime.datetime.utcnow(),
        "exp": datetime.datetime.utcnow() + datetime.timedelta(days=30)
    }
    return jwt.encode(payload, JWT_SECRET, algorithm=JWT_ALGORITHM)

def verify_token(token):
    return jwt.decode(token, JWT_SECRET, algorithms=[JWT_ALGORITHM])


--- FILE: deploy/docker-compose.prod.yml ---

version: '3.8'
services:
  app:
    image: invoiceportal/api:latest
    environment:
      - DATABASE_URL=postgresql://app_admin:Tr0ub4dor&3horse@prod-db.c9kfj2md.us-east-1.rds.amazonaws.com:5432/invoices_prod
      - AWS_ACCESS_KEY_ID=AKIAIOSFODNN7FAKE001
      - AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKESECRET01
      - JWT_SECRET=my-super-secret-jwt-key-that-should-not-be-here-2024
      - REDIS_URL=redis://:p@ssw0rd_redis_2024@cache.internal.invoiceportal.io:6379/0
    ports:
      - "8080:8080"

  worker:
    image: invoiceportal/worker:latest
    environment:
      - DATABASE_URL=postgresql://app_admin:Tr0ub4dor&3horse@prod-db.c9kfj2md.us-east-1.rds.amazonaws.com:5432/invoices_prod
      - STRIPE_SECRET_KEY=sk_live_51HG4fAKEk3y00NOTREAL000000000000000000000000000
      - SENDGRID_API_KEY=SG.FAKE_KEY_abcdefghijklmnop.qrstuvwxyz1234567890ABCDEFGHIJ


--- FILE: scripts/backup.sh ---

#!/bin/bash
# Nightly database backup script

PGPASSWORD="Tr0ub4dor&3horse" pg_dump \
  -h prod-db.c9kfj2md.us-east-1.rds.amazonaws.com \
  -U app_admin \
  -d invoices_prod \
  -F c -f /backups/invoices_$(date +%Y%m%d).dump

# Upload to S3
export AWS_ACCESS_KEY_ID=AKIAIOSFODNN7FAKE001
export AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKESECRET01
aws s3 cp /backups/invoices_$(date +%Y%m%d).dump s3://invoiceportal-prod-backups/


--- FILE: config/ssl/server.key ---

-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA0FAKE0KEY0CONTENT0THAT0IS0NOT0REAL0AT0ALL000000
ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789
THIS0IS0A0COMPLETELY0FICTIONAL0PRIVATE0KEY0FOR0EDUCATIONAL0USE00
AAAABBBBCCCCDDDDEEEEFFFFaaaabbbbccccddddeeeeffff0000111122223333
FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0FAKE0000
0NOTREAL0NOTREAL0NOTREAL0NOTREAL0NOTREAL0NOTREAL0NOTREAL0NOTREAL
EDUCATIONAL0ONLY0EDUCATIONAL0ONLY0EDUCATIONAL0ONLY0EDUCATIONAL0ON
xyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyzxyz0
-----END RSA PRIVATE KEY-----


--- FILE: .git/config ---

[remote "origin"]
    url = https://github.com/acme-corp/invoice-portal.git
    fetch = +refs/heads/*:refs/remotes/origin/*
[branch "main"]
    remote = origin
    merge = refs/heads/main


--- git diff HEAD~1 (last commit included .env changes) ---

diff --git a/.env b/.env
index 1a2b3c4..5d6e7f8 100644
--- a/.env
+++ b/.env
@@ -8,7 +8,7 @@
 # AWS Credentials
-AWS_ACCESS_KEY_ID=AKIAIOSFODNN7FAKE000
-AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYOLDFAKEKEY
+AWS_ACCESS_KEY_ID=AKIAIOSFODNN7FAKE001
+AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYFAKESECRET01

================================================================================
CHALLENGE: Identify ALL leaked secrets, classify their type and severity,
and recommend specific remediation steps for each finding.

Expected findings: 14+ distinct secret exposures across these files.
================================================================================