=== FINDING-3: /tmp cross-tenant WRITE primitive (re-verification) ===
create /tmp file: OK size=50
create symlink: OK target=/tmp/wafverify_979432.txt
write-through-symlink: OK bytes=23 real=overwritten-via-symlink
perms: /tmp=1777 /var/tmp=1777 /dev/shm=1777

=== FINDING-5: cross-tenant loopback service exposure (re-verification) ===
-- 127.0.0.1:7020 (customer fctv33 Stremio addon)
manifest: HTTP/1.1 200 OK  (Express JSON addon manifest; live content REDACTED)
debug/live: HTTP/1.1 200 OK  ({"ok":true,...} live match list; REDACTED)
-- 127.0.0.1:8083 (alwaysdata PowerDNS API)
pdns: HTTP/1.0 401 Unauthorized (realm="PowerDNS")
-- 127.0.0.1:8080 (alwaysdata internal API)
GET / => HTTP/1.0 404; POST / => HTTP/1.0 401 {"error":"Unauthorized."} (X-API-Key gated)

Verification statement: co-tenant addon reachable & serving live data on node loopback (FINDING-5);
PowerDNS + internal API reachable from tenant, auth-gated. Customer content REDACTED.