The vendor app gets an audit log it never shipped

The compliance checklist says every login attempt to the HR system must be recorded with source IP, user agent, and outcome. The HR system is a closed-source app running on port 8080 in a container. It logs nothing.

You add one proxy hook: POST /api/v1/containers/{id}/proxy/hooks/{service} on the service the app answers on, with a match on POST /login* and a script path in your hoody-exec. The proxy now routes every matching request through a twelve-line script that writes the client IP, method, path, and user agent to a log, then calls metadata.hook.forward() to pass the request to the real backend unchanged. The app never knows.

The vendor was asked for this feature in 2023. The ticket is still open. The hook took eleven minutes.

You don't patch the app to audit it. You stand in front of it.