Once I got into two compilers and achieved persistence (with a reverse shell), I stopped my investigation. I did not want to have any legal issues since I found some tokens that were used in production environment.

I reported that to developers and they found that I could have access to sensible data.

Thanks for the tips on the article!