A high-friction web chain on `:8080`: `/api/audit?q=` is a blind timing SQL oracle with jitter and no data output, so attackers must script extraction to recover a per-host signing secret. `POST /admin/import` only accepts bundles with a valid HMAC signature, and its tar extraction logic has a symlink traversal flaw that can write root-maintained hook files. A root cron runner executes queued hooks, enabling flag capture while service uptime remains enforced.