$ cat ~/tags/security — 7 entries
The /now entry commits to moving the last Tally Prime hop off the legacy VPN segment onto ZTNA. This is the plan, not a build log: what Phase 1 proved, what the last hop needs, and what done looks like — no completion claims yet.
Twice in 2026 the TweakDeals database was emptied from under the site — in August, 2,544 products at 10:32 UTC were zero by 11:05. Forensics, guards, and the prebuild cache that saved the site.
A placeholder nonce that shipped to production took this site down for 41 minutes. Here is the exact failure, why static headers cannot emulate per-request nonces, and the three fixes that made the site both faster and actually secure.
Five outputs before any migration sketch: netcheck UDP, DERP reachability, the cert subject names, the NAT shape, and the rollback plan. Drawn from the RDS cutover's transcripts and ADR-003.
Twingate routed RDS traffic fine — then RD Gateway rejected every session on certificate subject-name mismatch. The fix: win-acme DNS-01 plus one PowerShell script binding all four RDS roles every 60 days.
Five scripts carry one UUID from mint to production header — scripts/generate-csp.mjs, inject-nonce.mjs, finalize-csp.mjs, csp-check.mjs, verify-prod-csp.mjs. Two production incidents drew the map; the pipeline diagram in this post is the repo's own chain.
When TRA Oman blocked our VPN protocol, operations halted across 4 branches. Here is the technical and business breakdown of how we migrated to Zero Trust architecture and restored operations within 48 hours.