The Debug Backdoor We Shipped Ourselves
Alflora Research · 01 Aug 2026
Tl;dr
- Our Pages app (pages.alflora.app) contained a debug route —
/__login__/:token — that authenticated anyone as the platform admin using a hardcoded Gitea access token.
- It was written as a development shortcut and survived into production, where it functioned as a full login bypass.
- The route was removed, the container image rebuilt, and the endpoint verified dead with our own requests.
- Tokens in old
.bak files were treated as live and rotated, because backups don't expire exploits.
What we found
During a routine red-team pass over our own infrastructure — the same pass every service on this network gets before the internet takes its turn — we mapped the Pages app's routes the way an outsider would: no source access assumed, just requests and responses. One route answered differently from everything else. A debug login endpoint, left over from early development, that accepted a token in the URL and opened a session as the platform's administrative account.
The token it compared against was hardcoded. It was a real Gitea access token with real privileges. Anyone who had ever seen a config backup, an old commit, or a stray environment dump held a working master key — and the route turned that key into a browser session in one request.
Why it existed
For the most boring reason anything dangerous exists: it was convenient once. During early development, logging in through the real flow was slow, so a shortcut went in "for now". Then the feature shipped, the shortcut didn't get removed, and "for now" quietly became "forever". Nobody decided to keep a backdoor. Nobody decided to remove it, either — and in security, the second decision is the one that counts.
The fix
The route was deleted, not disabled. The container image was rebuilt from source so no layer of the old binary survived. Then came the part that actually matters: verification. We requested the old endpoint against the new deployment and watched it die — not by trusting the diff, but by curling it like an attacker would. Finally, every copy of the token we could find — including ones sitting in old .bak files — was treated as compromised and rotated, because a token in a backup is a token in the wild.
What it taught
Debug routes are backdoors with good intentions. The fix isn't a policy document; it's a habit: enumerate your own attack surface on a schedule, assume every shortcut shipped, and verify the fix with the same request an attacker would send. This is the whole method behind every note on this site — don't believe the changelog, test it yourself. The scanner traffic on this server's public IP has never once taken a day off. The only variable is whether the owner tried first.