# E17. Stage-three collection and configuration analysis

## Material and collection variants

Static examination of the large JavaScript payload records upload variants named main, pass and phase3. These are implementation labels rather than mutually exclusive data classes. The phase3 branch walks the home directory and selects candidate files by name and extension. Its lexical terms include keys, wallets, phrases, seeds, mnemonics, secrets, credentials, recovery material and tokens. Formats include JSON, YAML, TOML, INI, property lists and environment files. [S1]

This is broader than an environment-file search, but it does not parse every candidate file or identify every secret. Naming, access permissions and traversal limits affect the actual result. No endpoint collection yield is established.

## Traversal limits

The recorded defaults are eight minutes for the phase, two minutes per root, fifteen seconds for a directory read, 2,500 directories, depth six and 500 candidate files. Environment overrides can change several limits. Exclusions cover selected system, cache, dependency and cloud-storage locations. Defaults demonstrate bounded selection logic, not successful operation at scale. [S1]

On macOS the code probes readability of selected protected top-level home directories and skips failed or timed-out probes. This is conditional access checking and prompt avoidance. It does not prove a universal TCC bypass or that a prompt can never occur under different system versions and race conditions.

## Transfer configuration

The recorded upload path uses a default chunk size of 2 MiB and a five-retry chunk setting. A separate upload-until-success routine can repeat attempts with increasing delays capped at 120 seconds. These are distinct retry layers; neither proves delivery to the server. The inspected HTTPS request path disables certificate verification. That weakens server authentication but is not evidence that traffic was intercepted. [S1]

Build placeholders and GUS-prefixed settings expose server, token, client-seed, cleanup and transfer configuration. Bearer values are omitted. A setting's presence does not establish its effective value in every deployment.

## Limits

This document reports static source behavior. Network blocking can interrupt uploads; retry code does not make exfiltration inevitable. Successful receipt would require endpoint or server evidence. The reference sample is SHA-256 `694626bed2df1f0d0026a3f7ead7692b44c7e73041cdd799b79a025335533cdc`. [S2]