Threat-model the live channel

Before choosing a tool or writing more code, make the requirement concrete. The public incident feed exposes only public fields, while operator messages are authenticated, authorized, rate-limited, and audited.

A long-lived connection expands the time and volume over which an attacker can probe inputs and consume resources. The useful target is not encyclopedic coverage. Make one deliberate choice, observe its consequences, and know which requirement would make you revise it.

A common failure is to focus on transport encryption and ignore malicious messages or expensive connection behavior. The happy path may still work, which makes the mistake easy to miss. map trust boundaries, minimize payloads, validate every message, limit connections and rates, and log privileged actions. Keep the first version small enough that every important input and output remains visible.

This supports the module goal: Ship a live feature that has limits, useful telemetry, a degradation path, and a repeatable failure test matrix. Capture the request, command, trace, screenshot, test result, or other evidence that proves the result.

Write abuse cases for connection floods, oversized messages, forged commands, stale credentials, and sensitive event fields. Change one condition on purpose, predict the result, and compare the prediction with what actually happened.