Shared-token auth was off on prod (no MAPPA_API_TOKEN) — anyone with network access could call /admin/purge_secrets and all mutations. Token generated, stored in pass mappa/full-env, wired into stack env + agent MCP configs (~/.claude.json). Redeployed via Portainer (stack 27). Verify: /inbox without token → 401, with token → 200.