# Security And Reliability Assessment: 2026-07-15 Kafka file-download consumer-group replay and Nearmap throttling

Incident: `INC-2026-07150002`  
Primary classification: Reliability / production partial outage  
Security severity: `medium` pending credential-exposure assessment

## Reliability Assessment

The confirmed outage mechanism is release-created Kafka offset-lineage abandonment followed by retained-history replay. Current production health after rollback does not establish permanent remediation readiness.

The candidate retry policy matches Nearmap's recommendation to retry 429 and 5xx with exponential backoff and not other 4xx. It does not yet consume Nearmap rate-limit headers or coordinate a provider-wide budget across replicas. With 3 concurrent partitions per pod and up to 5 pods, as many as 15 full downloads may run before retry amplification.

## Security Assessment

No evidence currently indicates malicious activity, unauthorized customer-data access, or customer-data exfiltration. Two adjacent urgent findings require separate closure evidence:

- Kafka-derived folder/name path joins can traverse outside the intended root while the container runs as root.
- Startup logging of Kafka SASL/SSL objects may include credentials or private-key material.

The credential action requires value-safe source/log review, exposure assessment, scoped rotation, old-credential failure proof, and confirmation that no secret values are printed in evidence.

## Additional Runtime Risks

- Fully buffered responses have no size cap.
- Retry duration can exceed Kafka session ownership while `eachMessage` does not heartbeat.
- No request-level idempotency or transactional output-plus-offset commit exists.
- Health can remain green after the consumer run loop fails.
- Release CI and on-prem overlay checks are not hard deployment dependencies.

## Regulatory Position

No breach-notification trigger is currently evidenced. Contractual customer-notification requirements remain subject to Customer Success and legal review after exact impact enumeration.