- Shipped
- September 23, 2026 at 12:53 PM UTC
- Author
- Kamo
- Commit
- 72c8d75
NATS mapped every credential-less connection to the KAMO account (no_auth_user), and it listens on the host network of k1m1 — so any pod, the desktop VM or a machine on the LAN could read and forge the platform's realtime traffic without a password. That mapping is being removed (klusterservices 926986d). This server opens three connections — the org-change publisher (rt.org.* signals every open screen refetches on) and the Universe page's worldlive and worldgen subscriptions — and none sent a login, so all three would be refused. app/lib/natsLogin.ts returns { user, pass } from NATS_USERNAME / NATS_PASSWORD (both halves or neither), each connect() spreads it, and the deployment fills both from the nats-client-credentials Secret. natsLogin.test.ts covers the helper and guards every connect() under app/ that imports 'nats' (it asserts it found at least the three sites, so it cannot pass by collecting nothing; red when any site drops the spread).