The page arrived at 03:12. LOGIN_SUCCESS_RATE_LOW — tenant: northwind-fs. The first thing I did was open the global dashboard, because that is what you do. Aggregate login success rate: 99.94%. Flat. Token issuance rate: normal for the hour. Error rate: 0.06%, which is where it
The ticket said "login broken for entire Manila office." It arrived at 01:14 UTC, which is 09:14 in Manila, and by the time anyone read it there were nine more like it. Nothing was broken. Three weeks earlier someone had shipped a per-IP limit on POST
At 09:02 on a Monday, an identity platform I know of started returning timeouts on /token for every tenant it served. Not one tenant. All of them. The incident channel did what incident channels do and went looking for the attack. The traffic graph had a clean 6× step
At 03:40 the ward is quiet enough that you can hear the infusion pumps. A nurse comes out of a side room, pulls off one glove, and stands at the computer on wheels parked in the corridor. She needs to chart a dose she gave four minutes ago, check
After a credential-stuffing incident that turned into a small forced-reset exercise, a team I was working with did the sensible post-mortem thing: they took the passwords that had actually fallen, and replayed them through their own signup form to see what the strength meter had said about them. All of
The policy change was approved unanimously, which should have been the first warning. Minimum length went from eight characters to twelve. Four character classes became mandatory instead of three. The slide deck had a keyspace calculation on it: the old policy admitted about 2⁵² passwords, the new one about 2⁷
The ticket was titled "remove cost_center from the access token." One line of claim mapping. The estimate was two points. It took eleven months. Not because the mapping was hard to delete — because nobody could say what would break. The claim had been added in 2019 for
The queue had forty-one items in it when she picked it up on Monday morning, and by the third coffee she had a rhythm. Alert 7: user in Bangalore, then Singapore, eleven minutes apart. Resolution: the company's egress for SaaS traffic is in Singapore, and the user'
The ticket said: "On Thursday between 09:10 and 09:52, roughly 3,000 of our users couldn't sign in. One who should not have been able to sign in, did. Please explain." We had an audit trail. Seven-year retention, SOC 2 evidence, the works. Here
The fix took four minutes. Getting permission to apply it took fifty-one. A payments company, a Saturday, a bad config push to the identity platform's runtime that made token issuance fail for about a third of requests — enough that the API was broken but not enough that anything
The finding read: nine days of unauthorized access by a terminated employee. It was wrong, and it was also unarguable, and the argument about which of those was more true consumed most of a quarter. Here is what happened. A contractor-turned-employee in a regional sales office resigned on 3 March.
The ticket was closed as "cannot reproduce," and that turned out to be the most alarming sentence anyone wrote that quarter. A customer had been locked out of her account on a Tuesday in March. Correct password, correct TOTP code, then a screen saying her sign-in couldn'