the exposed default, made impossible

A development database was published on every network interface rather than the loopback one. It was found by a scanner, brute-forced, and left carrying a back door. Nobody had decided to expose it. The default mapping did that, and every author who ever typed a bare mapping inherited the default without reading it.

The response that matters is not the one that closed the port. Closing a port fixes an instance and leaves the next author exactly as free as the last one, because the default is still the thing that writes the mistake. So the default moved first: bare mappings now bind to loopback at the daemon level, which makes the unsafe exposure require an explicit act rather than an omission. Then a guard where the mistake is actually made — a repository check that refuses a change introducing a new publication beyond loopback, before it reaches any environment. And a written policy on network exposure, so the guard has a text to point at.

The same pattern was applied later to a second exposure class: a change-time guard on the job definitions, alongside the policy, so the rule is enforced where the definitions are edited instead of being rediscovered by an audit.

Cost: legitimate workflows now need a visible exception, and the guard will sometimes be wrong about a change that was fine.

What it proves: after an incident the team hardens the class rather than the instance, and puts the fix where the mistake gets made.