diff --git a/infra.tf b/infra.tf
index f849e99..c9fb1fb 100644
--- a/infra.tf
+++ b/infra.tf
@@ -14,15 +14,15 @@ resource "aws_s3_bucket_public_access_block" "backups" {
   restrict_public_buckets = false
 }
 
-# VULN 2: Security group open to the entire internet on every port (incl. SSH).
+# Security group scoped to HTTPS from within the private network only.
 resource "aws_security_group" "open" {
-  name = "allow-all"
+  name = "restricted-ingress"
 
   ingress {
-    from_port   = 0
-    to_port     = 65535
-    protocol    = "-1"
-    cidr_blocks = ["0.0.0.0/0"]
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/8"]
   }
 }