◈ReguNav™Trust
Incident History

Public incident timeline

Every incident — even ones with no customer impact — is logged here within 72 hours of closure. Detection time, root cause, remediation, and customer-impact assessment in plain English. We publish what we would want to read.

Disclosure policy

We publish every incident that meets ANY of the following: customer-facing surface degradation, data integrity question, security incident, or regulatory-reporting obligation triggered.

Disclosure timeline: customer notification within 24 hours of detection; public log entry within 72 hours of closure; full post-mortem within 5 business days for P1/P2 (linked from the entry below).

All entries below are mirrored to the WORM audit trail (Principle #45). The customer-impact statement is reviewed by the DPO before publication when personal data is in scope.

Timeline

INC-2026-001P3resolved

Cloudflare Pages: deploys landing as preview, not production

Opened 2026-05-02 16:38 UTC
Closed 2026-05-02 17:14 UTC
Summary

Cloudflare Pages projects had production_branch set to 'production' (the initial default) rather than 'main', causing every wrangler deploy --branch=main to land as a preview deployment. The custom-domain alias stayed pinned to the last production deployment, so live URLs went stale.

Customer impact

No customer data affected. trust.regunav.com + landing displayed stale content for ~36 hours. Resolved before the next billing cycle.

Root cause

The Pages project create command set production_branch on CREATE only; subsequent code-deploys did not update it. Our deploy step had no idempotent PATCH to enforce production_branch=main.

Remediation

Deploy workflow now PATCHes production_branch=main on every deploy (idempotent). cf-pages-remediation workflow scans + repairs any project drift. Per Principle #38 root-cause fix: monitoring + alert added so stale-prod never sits silent again.

Affected:regunav.comtrust.regunav.comframework.regunav.com
INC-2026-002P3resolved

All-Surfaces Verify probe silently failing

Opened 2026-05-17 05:50 UTC
Closed 2026-05-17 08:43 UTC
Summary

The probe loop in all-surfaces-verify.yml used `IFS='|' read -r HOST PATH APP <<<"$spec"` which clobbered the shell's $PATH inside the loop body, breaking every external command (curl, head, grep). Findings table showed empty HTTP code for all 16 surfaces.

Customer impact

Probe was non-functional but workflow reported failure correctly; no false positives reached customers. No customer data affected.

Root cause

Bash special-variable name shadowing. Variable named PATH overwrites system PATH for the duration of its scope.

Remediation

Renamed loop variable PATH → URL_PATH in all-surfaces-verify.yml and API_PATH in deploy.yml. Added workflow-validator rule `shell-reserved-shadowing` that blocks any future read-assignment to PATH / HOME / USER / SHELL / LANG / TERM / UID / PWD / OLDPWD / HOSTNAME. Pre-commit + CI both enforce.

Affected:Internal observability only

Subscribe

Email incidents-subscribe@regunav.com to receive new incident notifications in real-time. Auditors and tier-1 customers also receive RSS / webhook delivery via the auditor portal.

Page last updated automatically when an incident is opened or closed. WORM-anchored. The complete chain is replayable via the audit-replay engine for any timestamp.