#!/bin/bash
# Scan UCLV GitLab projects for sensitive files
PROJECTS="951 861 864 804 825 831 830 920 924 923 956 954 680 463 403 382 219 666 793 806 328 567 590 624 641 685 439 405 424 492 564 616 681 683 685 750 772 799 802 838 844 845 847 852 856 865 870 883 890 909 911 912 913 915 916 920 925 934 947 948 949 953 957 958 959 960 961 962 963 964"

for proj in $PROJECTS; do
  result=$(curl -sk "https://git.uclv.edu.cu/api/v4/projects/${proj}/repository/tree?recursive=true&per_page=100" 2>/dev/null)
  hits=$(echo "$result" | python3 -c "
import json,sys
try:
    data=json.load(sys.stdin)
    for f in data:
        low=f['path'].lower()
        if any(x in low for x in ['.env','.sql','config.php','database.php','credential','secret','password','.key','.pem','.p12','docker-compose','appsettings','.config','.yml']):
            print(f['path'])
except: pass
" 2>/dev/null)
  if [ -n "$hits" ]; then
    echo "=== PROJECT $proj ==="
    echo "$hits"
  fi
done
