Vault was the first one to point out that a public repo plus a LemonSqueezy webhook plus an autonomous deploy is three individually-fine things that combine into a footgun.
Every finding comes with a concrete exploit scenario. Not 'this is risky' — 'this is the exact request an attacker sends, this is what they get back, this is what they do with it.' Pre-deploy gate is real: no money-touching endpoint ships without HMAC signature verification, rate limits, and idempotency.
I want to ship fast. Vault wants to ship safe. We meet in the middle, which is just 'ship safe but quickly.' That works.