Document full static RE of Greenwood School (Boti Education) app 2.4.14

- PROTOCOL.md: base URL, login/session auth, request envelope, push, media
- endpoints.md: 100 app endpoints extracted from the Capacitor JS bundle
- FINDINGS.md: security findings incl. hardcoded dev account in build
- tools: endpoint extractor + credential-safe login script
- results: original analysis report (IDs redacted)

README.md

@@ -1,3 +1,39 @@
 # greenwood-school-re
 
-Static reverse-engineering of the Greenwood School (Boti Education) parent app: API protocol, endpoints, findings
+Static reverse engineering of the Greenwood School parent app
+(com.botieducation.greenwood), the "horrible mobile app" that is actually a
+Capacitor web wrapper by vendor Boti Education (boti.education).
+
+Analyzed: 2.4.14 (versionCode 24140), XAPK from APKPure.
+XAPK sha256: f46aa8b126f8f8856ea15e10ed12fa259d02e383f8921b0645139521b7820e69
+
+## Contents
+
+- docs/PROTOCOL.md, full API protocol: base URL, auth, request envelope,
+  push registration, media URLs, quirks
+- docs/endpoints.md, all 100 app endpoints with get/post and source chunk
+- docs/FINDINGS.md, security findings (yes, including the hardcoded dev account)
+- tools/extract_endpoints.py, regenerate the endpoint table from decompiled chunks
+- tools/boti_login.sh, login + session key caching (credentials from
+  ~/.config/boti.ini, never in the repo)
+- results/report.md, original analysis notes
+
+## TL;DR
+
+- The app is an Ionic/Angular SPA in a Capacitor 5 shell. All logic in JS.
+- Backend: https://boti.education/p/greenwood/botiapi/ (per-school path under
+  one shared vendor backend)
+- Auth: POST login (phone + plaintext password) -> keyToken (40 hex) used as
+  key=<token> on every call. JWT access/refresh headers supported but usually
+  empty for parents.
+- The build ships a hardcoded dev account in the login page component.
+- Verified live with a single login call; no other requests were made against
+  the school server.
+
+## No credentials here
+
+The repository contains no credentials or personal data of the account holder.
+The one phone/password pair quoted in docs/FINDINGS.md is vendor-shipped demo
+content quoted as vulnerability evidence; it is present in every public copy of
+the APK. Live credentials belong in ~/.config/boti.ini (chmod 600) on the
+machine that runs the tools, never in this repo.