A 502 Bad Gateway almost never means your application code is broken, and in the four architectures that produce most of them — nginx in front of an app, an ALB in front of a fleet, a CDN in front

A 502 Bad Gateway almost never means your application code is broken, and in the four architectures that produce most of them — nginx in front of an app, an ALB in front of a fleet, a CDN in front
A server with password authentication enabled is not "unhardened yet" — it is a live, addressable target from the second its IP is routable, and the interval between creation and hardening is the only security control you have not applied.