
A security audit finding rarely looks like an incident. It's a line item in a spreadsheet, a control marked "not effective," a remediation deadline three weeks out - and it very often traces back to NGINX configured for functionality first, with security bolted on afterward...