Operations

Full server/ codebase sweep (296 files; 5 parallel domain agents + adversarial verification). 2 HIGH on public endpoints — crypto deposit webhook double-credit on replay, Steam login open redirect. 3 admin route groups (/commands, /internal, /cron) downgraded to defense-in-depth given Cloudflare Zero Trust gating. Includes prioritized remediation.

25 repos, 67 critical + 383 high npm vulnerabilities. Real supply-chain attacks (axios, chalk/debug, Shai-Hulud) from the last 12 months, cost of delay vs. breach, and the ask — in plain language for product leadership.

data-node-4 search queue hit the 1000-thread cap at 07:46–47Z, emitting ~545 rejections; root cause is a ~950-item must_not.assetId filter amplified by JS-side gzip decompression (libuv pool overload) and JSON.parse blocking the event loop. Fix already exists as PR #1284 (Apr 27, OPEN+BLOCKED, 7 days unmerged) — folds in profiler findings from the Apr 16–17 diagnostic.

data_node_1 + data_node_4 hit load.1 5.3 (CPU 60–87%) for ~10min; backend Node.js event loop stalled 1–3s in same window AND independently at 14:41Z. Two problems, real correlation, causation NOT proven without OS metrics. PR #1246 enabled runtime metrics that made the event-loop problem visible.

2 of 4 data nodes breached load.norm > 1.0 after marketplace-aware rollout; new bulk engine (2 parallel workers + refresh-window) removed the natural pacing from per-chunk refresh: true; PR #114 backpressure pending

RDS steamarbitrage at 96% CPU with 3,400 connections + OpenSearch sequential queries causing 10s page loads

Nuxt frontend nodes hit 92% CPU + OpenSearch data nodes reached 95%, one node crashed

OpenSearch data_node_4 at 60%+ avg CPU, two error bursts (~193/5min), backend CPU 52% peak