A gateway’s bind address was tightened to loopback, the safer-looking change. It silently disabled authentication, and a request carrying a wrong bearer token came back 200. Credentials shared by four gateway processes expired on 27 July and nothing noticed for two weeks. A prompt passed as a command-line argument reported no tools, and the same prompt pasted two seconds later had them, so scheduled jobs were answering from memory and reporting success. An update feed advertised a version whose artefact had never been published, and served the 404 with max-age 31536000.

For you if: you self-host. A gateway, a tunnel, credentials more than one process reads, and hardware you cannot add to.

Not for you if: your compute is elastic. If you can add instances with a credit card, this is a cost exercise and not a capacity one. On a managed platform where the vendor owns the gateway and the runtime, most of this has no surface to attach to.

Included: 18 SKILL.md files, 48,056 words, covering infrastructure and deployment, and credentials and access.

Fourteen days, no questions asked. No reason required, nothing to delete, and nothing to prove. That applies wherever you bought from. Read “Not for you if” above before you buy.

Questions before you buy: support.ashgrovelabs@gmail.com, or support@ashgrovelabs.app which reaches the same inbox. We reply within one business day, Monday to Friday.