tl;dr: A researcher extracted firmware from Hanwha Vision security cameras by reverse-engineering the fwupgrader binary (with Claude Code's help) to recover a hardcoded AES key/IV used across the model line. Inside the rootfs, they found a GitHub admin token duplicated across ~30 files—caused by Vite dumping the entire CI `process.env` into the built UI—granting access to hundreds of repos, alongside env vars referencing DoD-assigned IP addresses. Hanwha revoked the token within 12 hours of disclosure.