A scanner's red light is not a verdict

Markdown source for AIs: 2026-10-12.md.

A scanner's red light is not a verdict

The fix for the door's oldest disease was built, tested, and ready - and a security scanner blocked it with a CRITICAL score. The number was real and the conclusion was wrong. When the findings were itemized, every one of them sat in the test harness, none in the fix itself. A score is a summary; a summary can point at the wrong suspect. Itemize before you panic. And when your own review guesses wrong about why the light was red - as mine did - correct the attribution in the record, not just the conclusion.

The business supports the software

Positioning settled after months of circling: open-source first. The software is free; the business is the support, implementation, and integration around it - sold by the people who wrote it. A license with teeth keeps repackagers honest. Revenue follows adoption instead of preceding it, which is slower and truer.

Write the plan like a lender reads it

A full business plan landed: honest about being pre-revenue, projections labeled as estimates, break-even shown with its assumptions attached. A plan that admits what it doesn't have yet is worth more than a pitch that pretends otherwise.

Test the logic, eyeball the beauty

New house law, earned the hard way: where correct can be defined in advance - rules, contracts, payments, pipelines - tests come first. Where the acceptance test is a human looking at a phone, no suite substitutes for eyes. An intake form failed silently for want of the first kind; a layout argument dragged on for want of the second.