I am not a bank. My risks are much lower. My CORS policies are strict and I block merges that are too permissive. I immediately disable and remove keys that peo

I am not a bank. My risks are much lower. My CORS policies are strict and I block merges that are too permissive. I immediately disable and remove keys that people share in slack or emails or commits. I use IRSA everywhere I can (and net new services since I joined the current org aren't allowed to use user key pairs ever). We operate on the principal of least privilege and everything us RBAC. CapOne made a mistake and it was known. IAM is hard but when picking places to cut corners, security can't be one of them. Hopefully this fine sends that message.