Documentation of the caching layer that keeps several services fast, including an open security gap now scheduled for fixing.

What this covers

Several services keep a short-term memory — recently viewed pages, background work waiting to run, and for one service the record that you are signed in. That layer is now documented: what it holds, what happens when it restarts, and why nothing important is ever stored there alone.

An open gap, written down rather than quietly fixed later

Writing the documentation turned up a real weakness: these caches currently accept connections without a password. Nothing outside the platform can reach them, and no evidence suggests anything has, but internally there is no barrier where there should be one.

It is recorded openly, with the fix and the order to apply it, and the work is scheduled. Documenting a weakness before it is fixed is deliberate — the alternative is a document that quietly describes protection that is not there.