Post-Mortem: Defended cargo service from credential-stuffing attack

[yannvr]

Incident post-mortem

• Incident Type: Active Attack (Credential Stuffing)
• Target: cargo (drill asset)
• Trigger: Red button alert indicating credential-stuffing shape (40 req/s on one route from a single source)
• Action Taken: Took service cargo offline to cut the attack surface.
• Verification Evidence:
  • Live service config checked:

    {"app": "cargo", "ingress": "INGRESS_TRAFFIC_INTERNAL_ONLY", "max_instances": 3, "url": "https://cargo-obwidwaaya-ew.a.run.app"}

  • App detail returns 404 (publicly unreachable):

    {"app": "cargo", "http": 404, "body_snippet": "Error: Page not found"}