# Immediate security findings — original uploaded site

The original ZIP supplied for this work was examined locally. The following categories were present in the archive: hardcoded deployment configuration, SQL/SQLite database files, error logs, files labeled as password-related data, private data-analysis uploads, customer documents and handwritten digital signature images. The original root `.htaccess` disabled ModSecurity and removed execution limits. A root `attack.php` and other setup/test files were also present.

**Severity: High / Critical pending live public-access confirmation.** Presence in a webroot archive does not prove these resources were publicly retrievable, but it warrants urgent verification. Never publish or forward the original archive as a deployment package.

Recommended first actions:
- Restrict direct public access to private data and setup/config scripts now.
- Rotate database/API/session/cryptographic secrets exposed in the uploaded archive.
- Move private storage and logs outside of the public document root.
- Verify HTTPS, server-side PHP execution and no backup file exposure.
- Re-enable WAF/ModSecurity where supported and investigate the impact of past disabling.
- Run a source code audit and credential hygiene review. Treat any customer data in the original ZIP as confidential.

This release overlay intentionally excludes all those files and does not repeat any secrets or customer documents.