Add audit reports and fix plan for DevTrack #1259

audits/AUDIT_env_1259.md

@@ -0,0 +1,53 @@
+---
+agent: env-validator
+status: PARTIAL
+timestamp: 2026-06-25T00:00:00Z
+findings_count: 2
+errors: []
+---
+
+# Env Validation — DevTrack #1259
+
+## FAIL
+- **okta-login.html.j2:102** — Real email address hardcoded in template: `Brian.Caldwell@Zimperium.com`
+  - Location: HTML form hidden input field (`fromURI` parameter)
+  - Risk: PII leak in template asset; exposed in version control
+  - Details: Value is HTML-encoded (`/`, `&`, `%40`, etc.) but fully readable when decoded
+
+- **okta-login.html.j2:206** — Real Okta organization reference hardcoded: `zimperium.okta.com` + Okta app ID `exk1ufbfxuFLJp6y3697`
+  - Location: JavaScript variable `baseUrl` and `fromUri` in login page script
+  - Risk: Identifies real target organization; enables direct OSINT attack path
+  - Details: Okta app ID (`exk1ufbfxuFLJp6y3697`) is a unique identifier that can be used to enumerate target infrastructure
+
+## WARN
+None
+
+## PASS
+- **lander_gen.py** — Credentials passed via config dict, written to temp JSON files with mode 0o600, deleted after use. No filesystem persistence of secrets.
+- **deploy_phishing.py** — SMTP password and other credentials collected via input prompts, stored in memory-only config dict, passed to Ansible via temporary JSON file (mode 0o600). No hardcoded secrets detected.
+- **cloud-lander.html.j2, js-payload.js.j2** — Template variables only; no hardcoded secrets.
+- **nginx-phishing-webserver.j2** — Nginx configuration template; no hardcoded credentials.
+- **phishing-landing-page.j2** — Generic login template with Jinja2 placeholders; no hardcoded PII or secrets.
+- **microsoft-login.html.j2** — Phishing template with placeholder values; no real credentials embedded.
+- **Git history** — No evidence of secrets committed in recent git history (for these files).
+
+## Remediation Required
+
+### Critical
+Replace okta-login.html.j2 with a **parameterized template**:
+
+1. Remove hardcoded `Brian.Caldwell@Zimperium.com` and `zimperium.okta.com`
+2. Replace with Jinja2 variables:
+   - `{{ target_email | default('') }}`
+   - `{{ okta_org_url | default('https://okta.example.com') }}`
+   - `{{ okta_app_id | default('') }}`
+3. Populate these at deployment time via config dict, never in version control
+4. Add a comment in the template: `<!-- Template variables: target_email, okta_org_url, okta_app_id -->`
+
+### Process
+Ensure all phishing templates follow the same pattern:
+- **No real email addresses** in source
+- **No real domain/org references** in source
+- **All campaign-specific data injected at runtime** via Jinja2 context
+- Credentials and PII sourced from config dict passed by `deploy_phishing.py`, never hardcoded
+