ArcadiaCloud.Guardian had no secret_key for prod at all — every authed route would fail at deploy. Wire it from GUARDIAN_SECRET_KEY, raising when absent in prod; keep the pinned dev/staging default. Ecosystem audit 2026-06-20, rank 2 blocker. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>