A stack with TLS in front of it was still publishing nginx on 0.0.0.0,
so the admin stayed reachable over plain HTTP on a raw port while the
proxy served the same site over HTTPS beside it. On this project's own
instance that meant wp-login.php answering 200 to the open internet.
There is no password to steal — the account is a key — but the session
cookie is the account, and a cookie read off the wire is a logged-in
administrator.
HTTP_BIND defaults to 0.0.0.0, so a stack with nothing in front behaves
exactly as before. The records doc now also explains the pinned
self-signed certificate route, which is how a BCNR name gets HTTPS
without a certificate authority — and why an editor needs it at all:
the publishing key is derived in the page, and crypto.subtle does not
exist outside a secure context.
582cc81ffe