Sam Curry and Shubs Shah found exposed credentials and source code in a publicly accessible .env file and .git repository on a Chinese development subdomain for ClubWPT Gold.
Leaked usernames, the password 123456, and an unauthenticated endpoint that let them overwrite anyone’s 2FA secret got them into the production back office, exposing driver’s licenses, passport numbers, IP addresses, transactions, and game history.
All-in on security vulnerabilities: the house always loses when you leave your .git folder public.
