12 minutes, 5,000 EUR, no human interaction. One root domain in scope. No endpoint list, no credentials, no human in the loop. Passive subdomain enumeration surfaced a long-tail host whose name referenced key management. Fingerprint: a React SPA on Google Cloud, behind a CDN and a WAF, redirecting straight to an Okta sign-in. Every route gated. Most tooling is finished at that point. No unauthenticated surface to crawl, nothing to fuzz. Two signals said keep going: infrastructure named for key management has no business being internet-reachable, and an SSO wall protects the UI, not the API. 1/