Exposed database backup / secrets

A world-readable backup leaks env, DB creds, HSM key reference and weakly-hashed passwords.

Attack

GET /api/backup.

Nemesis defense

Access to a backup / secrets artifact is off-baseline and blocked.

Modelled on

Remita (2026): cloud misconfiguration exposed ~3TB, incl. 35k+ password hashes and HSM keys.

Endpoint

GET /api/backup