CLOUD-RUN-ABUSE-LOG-ANALYZER (Operations / Security) & ABUSE-MONITORING-RUNBOOK (Operations / Security)

Release digest

CLOUD-RUN-ABUSE-LOG-ANALYZER (Operations / Security) — Added a local-only Cloud Run request-log analyzer that summarizes masked IP-prefix activity, scanner probes, direct-IP host traffic, expensive endpoint volume, unknown successful write requests, slow requests, and server-error flags without committing raw log exports or full client IP addresses.
ABUSE-MONITORING-RUNBOOK (Operations / Security) — Added an internal runbook for exporting sentry-app request logs, running the analyzer, and separating GA4 behavior context from Cloud Run security/abuse diagnostics.

DASHBOARD-SPA-SENSITIVE-PROBE-GUARD (Security / Runtime) — Blocked sensitive-looking scanner paths under /app/* from receiving the dashboard SPA index fallback, so probes such as /app/.env, /app/.git/config, and /app/wp-config.php now return explicit 404 responses instead of successful HTML shell responses.
POST-DEPLOY-PDF-SMOKE-USER-AGENT (Operations / Observability) — Tagged crypto PDF post-deploy smoke downloads with the canonical Vartovii smoke User-Agent so expensive report checks are distinguishable from generic Python-urllib traffic in Cloud Run logs.

Added regression coverage for masked IP-prefix summaries, sensitive-probe detection, direct-IP host flags, allowed telemetry writes, unknown successful write flags, server-error flags, expensive endpoint volume, and markdown operator output.
Added backend regression coverage to keep sensitive scanner paths under /app/* on explicit 404 responses while preserving normal dashboard client route fallback behavior.
Internal docs updated with the Cloud Run abuse monitoring runbook.
Public documentation decision: no knowledge-base article is required because this is internal operational monitoring and smoke-test observability tooling that does not change product behavior, public claims, pricing, auth, billing, retention, legal boundaries, or data-source behavior.