Red Heron: Access to Gitea config/secrets files (app.ini, JWT, SSH host keys, deploy keys)

Arnold Chan@slaz

•updated Sep 15, 2026•0•0•1

Detects access to Gitea secrets and configuration (app.ini, JWT secrets, SSH host keys, deploy keys) via file writes/renames or process command lines referencing those paths alongside Gitea, matching the secret-extraction tradecraft observed in the Red Heron campaign.