// SELF-AUDIT
How we test ourselves
Continuous transparency beats any claim of zero false positives. These are real issues we found in our own product, fixed, and re-verified — described without exploitable detail.
Stop control that didn't stop anything
We shipped a control to halt a running scan mid-attack. When we tested it live against a real target, the button didn't respond. We traced it to a styling rule that silently disabled the entire control panel while a scan was active — the button was visible but inert. Fixed and re-verified the same day against a live scan.
A live channel that kept quietly dropping messages
Our internal event bridge was reconnecting every 5 seconds without raising any error — messages published during the gap were silently lost, about 40% of the time. Our first attempted fix stopped the visible reconnect loop, but our own monitoring caught that it left the channel silently hung after any outage. We reverted and shipped a version that actively checks it's alive, instead of only watching for disconnects.
Two timestamps, one clock
A background process was recording a scan's start and finish time as the exact same instant — both captured when the record was saved, not when the scan actually started or ended. Fixed so each timestamp is captured only once, at the moment it actually happens.
Our own sample report contradicted itself
One line said it matched our production report format exactly; another, on the same document, admitted that format wasn't ready yet. We caught the contradiction ourselves, corrected the copy to be accurate, and are tracking the real fix — generating samples from the same engine production uses — as separate engineering work.
A form that logged more than it should
Our own marketing site's demo request form had no rate limiting and was writing full names, emails, and company names into plaintext logs. We added rate limiting, and reworked logging to keep only what's needed to debug — not people's contact details.
A status page that could never say anything was wrong
Our public status page always displayed "Operational" — a static string, not a real check. We replaced it with a live server-side health check against the same liveness signal our engine itself uses.
This is a static snapshot, not a live feed — dated August 17, 2026.