Campaign Statistics
A targeted sweep of Argentina's government digital surface — public git repositories associated with .gob.ar and .mil.ar domains — produced the following results. All data was retrieved from repositories that required no authentication to clone or browse.
The Comment That Wasn't Changed
Every framework ships with a .env.example file. Its purpose is to show developers what variables the application needs — with placeholder values, not real ones. For the JWT secret, the convention is usually to write: CHANGE_ME, or YOUR_SECRET_HERE, or GENERATE_A_RANDOM_VALUE. DSISPER's prison visits system used: CAMBIAR_POR_UNA_CLAVE_ALEATORIA_LARGA_Y_SEGURA — a Spanish instruction meaning "CHANGE TO A LONG SECURE RANDOM KEY."
The developer copied the .env.example to .env. They did not change the JWT secret. They committed it. They deployed it. The system is in production. The JWT_SECRET is the comment from the example file. Anyone who can read a public git repository can now forge a valid authentication token for Argentina's federal prison visits tracking system.
The secret was the instructions on how to make a secret. They committed the instructions.
This finding — a JWT secret left as a documentation placeholder — represents a complete authentication bypass. JWT tokens are signed with this secret. Knowing the secret means being able to sign any token, for any user ID, with any role claims. The door is unlocked because the key is the word "lock."
Critical Findings
Both repositories commit .env.production files using the same iosfa_admin credentials — one for the military personnel qualifications database and one for the armed forces medical appointments system. A JWT_SECRET_KEY is also committed in the calificaciones repository. One admin credential pair controls both military personnel rating and medical visit records for the entire Argentine armed forces.
JWT_SECRET in production .env is the literal Spanish instruction from .env.example: "CAMBIAR_POR_UNA_CLAVE_ALEATORIA_LARGA_Y_SEGURA" (Change to a long secure random key). Database credentials for sistemaVisitasPenales also committed. APP_ENV=production confirms this is the live deployment.
High Severity Findings
The API backend for Argentina's Plan GAS.AR national natural gas subsidies program uses default PostgreSQL credentials (user=postgres, password=postgres) committed to a public repository. No-password MySQL root also present. The plangas database manages subsidy program data for Argentina's national gas production incentive scheme.
Laravel .env committed with database credentials for the Rosario Municipal Social Security Institute's multiespacio system. APP_KEY also committed. Staging domain names a test environment but uses a dedicated database user with a non-trivial password.
Production OpenAI API key committed to the Mendoza province judiciary systems repository (CI_ENVIRONMENT=production). Represents ongoing unauthorized billing and usage risk until the key is revoked.
Targets Audited
Evidence Archive
Armed Forces qualifications DB — admin credentials + JWT secret key
Armed Forces visits system — same admin credentials, two environments
Prison visits tracking — placeholder JWT secret + DB credentials
Plan Gas national energy API — default PostgreSQL credentials
Complete credential inventory with remediation guidance for all 91 domains
Methodology and Scope
All data in this report was collected through passive open-source intelligence (OSINT) methods. No credentials were used to authenticate to any system. No databases were accessed, read, or modified. No systems were exploited or disrupted. All git repositories were publicly accessible without authentication at the time of collection (2026-04-02).
Findings were collected, analyzed, and held pending disclosure review before publication. No raw credential values appear in this public-facing report. Full credential details are available in the CREDENTIALS-MASTER.md archive for verified researchers, journalists, and affected parties.