v2026.08.28.03 — 2026-08-28

• fix(nginx): /.well-known/ paths other than acme-challenge were 404ing
• fix(security-advisor): lead CRA view with the audience question, not bury it