Production data in forty minutes, without touching the firewall

The question

The perimeter was well defended and the scope looked routine. The question was whether anything outside the inventory reached production.

How we approached it

Passive reconnaissance only at first: subdomain enumeration and HTTP fingerprinting, certificate transparency logs, and code search across public forks of the company's repositories.

What we found

• Two preview deployments on a third-party host exposed internal admin tools.
• Public code held a live bypass token for the admin route, committed next to a comment saying not to commit it.
• The preview's database was a production replica refreshed nightly, reachable about forty minutes after the first command.
• None of it produced a log entry the security team could see.

What it meant

Blocking tunnel tools would not hold. The fix was a sanctioned, SSO-protected way to share work in progress that is faster than the shadow path, which needed a conversation at CISO level rather than a line in the report.