Every tile topples the next: a leaked key, a forged JWT, and a little RFI cascade all the way into root.