/var/www/veridianhome/wp-content/themes/legacy-core/inc/backup-handler.php

"Burn it. Rebuild from a clean core. Also..." she paused. "You owe me an apology for revoking my SSH key last year."

"And the theme?" the CTO asked.

The repository revealed a developer had hardcoded FTP credentials in a deleted commit. She cloned the exposed repo locally and ran git log -p to find the last legitimate change before the breach.