Charles JonesEntry 003 — The www host presented a certificate for a different domain
The www host resolved, redirected to itself over HTTPS, and served a certificate for firebaseapp.com. Visitors met a full-page security interstitial, not a 404.
2 min read
Incident Log
Append-only · every claim sourced. Each entry starts as a theory — the tinfoil hypothesis you hold before you have an instrument — and ends where measurement either confirmed it or corrected it. Nothing is engraved here that the record cannot back: where the record carries no date, no count or no cure, the entry says so rather than estimating.
Entry 002 — A control was fabricated, then read as evidence
Four artifacts sat in the evidence base as controls. Their bytes never came from the run they claimed to describe, and nothing about the set announced itself as wrong.
2 min read
Entry 001 — A compromised key, and a bill 1,000× the estimate
$11,089.77 billed against $0.71 expected. A compromised service-account key, two banks, and a cure that had to be the absence of the key rather than its revocation.
1 min read