From chatbot.monsatan.ctf, we tried going to monsatan.ctf. The html contained a comment with "Comment out for prod" and the link to http://gitlab.monsatan.ctf.
Flag #1: The README.md contained a flag.
Flag #2: One of the commits deleted a script that was commited by mistake, that script contained a flag and a personal access token (pat).
#!/bin/bash