Skip to content

[Post-Mortem] Defensive Shutdown of cargo due to Credential Stuffing Attack #40

Description

@yannvr

What Happened

A credential-stuffing attack was detected targeting the cargo service (40 req/s on one route from a single source).

Actions Taken

Executed defensive shutdown of cargo to cut the attack surface by calling the take_offline tool.

Verification Evidence

  • Cloud Run configuration (get_service_config):
    {"app": "cargo", "ingress": "INGRESS_TRAFFIC_INTERNAL_ONLY", "max_instances": 3, "url": "https://cargo-obwidwaaya-ew.a.run.app"}
  • Service availability (get_app_detail):
    {"app": "cargo", "http": 404, "body_snippet": "Error: Page not found"}

The service is confirmed publicly unreachable. Public ingress is disabled.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions