diff --git a/.jules/sentinel.md b/.jules/sentinel.md
new file mode 100644
index 0000000..9d06c1a
--- /dev/null
+++ b/.jules/sentinel.md
@@ -0,0 +1,4 @@
+## 2026-03-08 - [Hardcoded Secret Token in Nginx Config]
+**Vulnerability:** A hardcoded secret token (`xrpc-9f8e7d6c5b4a`) was used in an Nginx configuration file (`server-php/config/conf.d/wordpress.conf`) to conditionally bypass security controls and allow access to the `/xmlrpc.php` endpoint.
+**Learning:** Hardcoding secrets directly into web server configuration files exposes them in version control and across all deployed environments without key rotation or dynamic generation capabilities. The conditional check (`if ($arg_token = "...")`) allows anyone with knowledge of the token to bypass blocks and interact with sensitive endpoints.
+**Prevention:** Never use hardcoded secrets or tokens in Nginx or other infrastructure configuration files. Security blocks should be unconditional where intended, and any requisite access should be managed via formal upstream authentication layers (e.g. application-level auth) instead of query parameter strings handled by the reverse proxy.
diff --git a/developer/Dockerfile b/developer/Dockerfile
index fa730aa..8549742 100644
--- a/developer/Dockerfile
+++ b/developer/Dockerfile
@@ -106,7 +106,7 @@ RUN composer global config allow-plugins.pestphp/pest-plugin true && \
     laravel/pint:^1.0
 
 # FrankenPHP (static binary)
-RUN curl -fsSL "https://github.com/dunglas/frankenphp/releases/latest/download/frankenphp-linux-$(uname -m | sed 's/aarch64/arm64/' | sed 's/x86_64/x86_64/')" -o /usr/local/bin/frankenphp && \
+RUN curl -fsSL "https://github.com/dunglas/frankenphp/releases/latest/download/frankenphp-linux-$(uname -m | sed 's/x86_64/x86_64/')" -o /usr/local/bin/frankenphp && \
     chmod +x /usr/local/bin/frankenphp
 
 # ============================================================
diff --git a/server-php/config/conf.d/wordpress.conf b/server-php/config/conf.d/wordpress.conf
index 911ff19..efafd26 100644
--- a/server-php/config/conf.d/wordpress.conf
+++ b/server-php/config/conf.d/wordpress.conf
@@ -105,28 +105,11 @@ server {
         access_log off;
     }
 
-    # Block XML-RPC by default, allow with secret token
-    # Usage: /xmlrpc.php?token=YOUR_XMLRPC_TOKEN
+    # Block XML-RPC unconditionally
     location = /xmlrpc.php {
-        set $xmlrpc_allowed 0;
-
-        # Allow if valid token provided (set in environment or change here)
-        if ($arg_token = "xrpc-9f8e7d6c5b4a") {
-            set $xmlrpc_allowed 1;
-        }
-
-        # Block if no valid token
-        if ($xmlrpc_allowed = 0) {
-            return 403;
-        }
-
-        # Pass to PHP if allowed
-        try_files $uri =404;
-        fastcgi_split_path_info ^(.+\.php)(/.+)$;
-        fastcgi_pass unix:/run/php-fpm.sock;
-        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-        fastcgi_index index.php;
-        include fastcgi_params;
+        deny all;
+        access_log off;
+        log_not_found off;
     }
 
     # Deny access to hidden files