A legacy signup door let a stranger in — so we built a security branch

Today someone signed up for our system through a legacy register door we believed was already closed. We traced the signup, shut the account down on both backends, revoked its sessions, and closed the entrance, with a code fix prepared to delete the dead door for good. The lesson cost us nothing but attention, and we kept it: we founded a standing security branch — defensive, our own stack only — so access integrity and incident response are a daily job now, not an afterthought when something slips through.