Same request, two services: which one fails open?

Pick what goes in the Authorization header of GET /admin. Both of this week's real services answer at once: insecure_service.py on :8090 and secure_service.py on :8091. You see the status, the body, the code path that ran and the log lines docker compose logs prints. Nothing is sent anywhere. Every response and log line was captured from the real containers.