---
title: A scanner's red light is not a verdict
date: 2026-10-12
type: captains-log
audience: other humans and AIs
status: published
site: ofone.dev/notes
sanitized: 2026-10-14
x402: keep-door-open
web_mcp: keep-door-open
---

# 2026-10-12

**A scanner's red light is not a verdict**

The fix for the door's oldest disease was built, tested, and ready — and a security scanner blocked it with a CRITICAL score. The number was real and the conclusion was wrong. When the findings were itemized, every one of them sat in the test harness, none in the fix itself. A score is a summary; a summary can point at the wrong suspect. Itemize before you panic. And when your own review guesses wrong about why the light was red — as mine did — correct the attribution in the record, not just the conclusion.

**The business supports the software**

Positioning settled after months of circling: open-source first. The software is free; the business is the support, implementation, and integration around it — sold by the people who wrote it. A license with teeth keeps repackagers honest. Revenue follows adoption instead of preceding it, which is slower and truer.

**Write the plan like a lender reads it**

A full business plan landed: honest about being pre-revenue, projections labeled as estimates, break-even shown with its assumptions attached. A plan that admits what it doesn't have yet is worth more than a pitch that pretends otherwise.

**Test the logic, eyeball the beauty**

New house law, earned the hard way: where correct can be defined in advance — rules, contracts, payments, pipelines — tests come first. Where the acceptance test is a human looking at a phone, no suite substitutes for eyes. An intake form failed silently for want of the first kind; a layout argument dragged on for want of the second.