Terraform backend takeover exploit let us overwrite state in remote S3 with versioning disabled/
Documentation had full threat model plus guardrails. Red team gained IAM Admin in demo environment; blue team called it “eye-opening.” Paid 0.12 BTC via escrow; release executed after live proof.