The server is in a critical security state Act now
Anyone on the internet can log into the master account with a password. Every app runs with full master privileges. Sensitive business and personal files have been downloadable over the web, and some of that data has already been retrieved by outside parties. Treat this as an active security and privacy incident.
How the 38 findings break down
The five things that matter most
Customer and recruitment data was publicly downloadable
The 36MB CV archive (251 CVs), the CRM customer database, leads and user files could be downloaded over the live website with no login. Treat it as an active incident.
Outside parties already took source code, secrets and agent files
Logs confirm 518 successful downloads of the code repository (71.9MB) by 48 sources, plus a 15-second automated run on 12 July that pulled the secrets file, source code, and the AI agent's instruction files.
The master (root) login is open to the whole internet with a password
Anyone who guesses the password gets total control. Bots try every few seconds: over 56,000 connection attempts recorded.
An unidentified address logged in as master 2,469 times
One outside address has been making live changes as root. It may be Lawrence's own automation, but that isn't confirmed. Confirming it is urgent.
This is likely a notifiable privacy breach
Personal information was exposed and some was confirmed taken. Under the Privacy Act this probably has to be reported to the Privacy Commissioner and affected people. The organisation needs to make that call promptly.
What's running on this server
One small DigitalOcean server (1GB RAM, Ubuntu) runs six applications behind a single web server, all under one master account.
Three public domains point (or have pointed) at this one box: go.limitlesslinks.co.nz, lawrencekenyonslade.co.nz and scripturecoin.com. A problem in any one app can reach all the others, plus every customer database and credential.
What has actually left the building
A file that could be downloaded is not the same as a file that was downloaded by an outsider. The left column is what the server logs confirm outsiders retrieved. The right column was exposed, with no proof of outside retrieval in the logs we hold.
Confirmed taken by outsiders
BreachedExposed, no proof taken yet
ExposedHow the exposure unfolded
Exposure window opens
A "Scripture Coin" web-server config starts serving the main app folder, which already held the code repository and lead data. This is the earliest date data could have been public.
First confirmed outside download
Web logging begins, and 51 minutes later an outside party successfully pulls /.git/config. 220 successful Git downloads occur this day.
The 15-second automated grab
One automated client makes 145 requests in 15 seconds and successfully takes 48 files (1.27MB): the secrets file, 11 Git items, 30 source and config files, the four AI-agent documents, and a 124-record personal-data file.
Secrets backup harvested
The .env.bak file is served to four external sources. The Resend email credential is treated as disclosed.
Partial patch applied
Someone adds a block so /.env returns "forbidden" over HTTPS. Git data, archives and databases stay open, and the fix went straight into production with no record.
Retrieval continues
Successful downloads of sensitive paths keep appearing in the logs right up to the assessment. In aggregate: 518 Git downloads to 48 sources.
This assessment
Discovery and reporting completed. Nothing on the server was changed, so remediation is not yet authorised or done.
The scale of personal data at risk
These are identifier counts, not a unique-person total, since the same person can appear more than once. A precise affected-person count is one of the open items in "What We Couldn't Test".
All 38 findings
Filter by severity or search, then click any finding to open it. Each has a plain-English explanation with the technical detail underneath.
Remediation plan and statement of work
The core hardening work is one fixed price of $2,500 plus GST, delivered as phases you can approve in priority order. An optional privacy add-on provides a breach summary email and a notification-ready document for the client to use as they see fit. The application code and deployment discovery is a separate fixed-price step at $1,500. Application code changes come later again, after that discovery.
Excluded from this statement of work
Handled as a later phase, priced after the discovery add-on (A2).
- Application code remediation: authentication, uploads, download routes, CRM token lifecycle, the dashboard fallback password and the catch-all file handler
- Dependency vulnerability upgrades and the testing that follows them
- Implementing the move of each app to its own service account (the actual decoupling from root)
- Full forensic disk or memory acquisition, or a rebuild from known-good source, if incident response is triggered
- Legal advice and any Privacy Commissioner filing
Fixed prices assume the scope described here. Tick steps to track progress; the tally is per browser session and resets on reload. This summary is indicative and becomes contractual only in the signed statement of work.
What we couldn't test, and why it matters
This review was strictly look, don't touch, and worked only from the server itself. Several important questions need extra access (the DigitalOcean account, Lawrence's own devices) or a business decision. These are the known blind spots.
Questions that need answers from you
Caveats on the evidence
The logs confirm data was served to outside requesters. They don't prove what was then done with it, or the identity of the person behind an address.
"Not found in the logs" is not proof something never happened. Logs only reach back to 10 July, cover one server, and record no hostname.
No passwords, keys, tokens or customer records were copied into any report. Only counts, sizes and structure were recorded.
If any unidentified root login turns out to be unauthorised, this moves from routine hardening to incident response: credential rotation from a clean device, and possibly rebuilding the server from known-good source.