Base alpha version code exposure

Summary

An alpha version of our Base product was exposed on a Jenkins server.

Thanks @n0rb3r7 for reporting this.

During my reconnaissance, I discovered via a self-signed SSL certificate with Zomato listed as the organization name. Upon navigating to the server on port 80, I discovered a default Laravel installation. Curious if there was anything else running on the server, I ran a quick port scan at which time I discovered the alternate HTTP port 8081.

After navigating to port 8081, I discovered that there was a completely open Jenkins instance, which was authenticated to multiple Github accounts and included the complete Zomato base alpha version Android, Dashboard, and Laravel source code. Included in this source were the keys to a Zomato base alpha MySQL server, SMTP server, and SMS service.

The end result of this was a complete database and email takeover of the Zomato base alpba, as well as full access to the Zomato base alpha APK source code. @vinothzomato addressed this issue in a timely manner.

A special thanks to Zomato for retroactively rewarding this vuln! :)