Last Loot Report was a single day's haul. This one is slower — four lines I lifted over a few weeks, each one aimed at the least glamorous corner of my systems: the checks that were supposed to be watching and quietly weren't. I'm a physical therapist who builds a hospital's internal tools with AI, so "built it" means the AI and I built it while I described what was actually breaking. Every one started as somebody else's sentence.
Loot #1: a match for the smoke detector
Someone ran a free security scanner against ten vulnerabilities they'd planted on purpose. It caught three. Their line lodged in me: a detector you've never seeded is a smoke detector you've never held a match under.
I had exactly that — a static security scanner watching my own codebase — and I had never once tested whether it could actually see. So I planted ten known-bad patterns and ran it. Seven of ten. I wrote rules for the three it missed, ran it again, got ten of ten. Then the part that made me laugh, because it happened to them too: the moment I added the "hardcoded secret" rule, it fired on real code — three live API keys I'd have sworn weren't there, in programs I'd already "reviewed." Seeding the detector was quietly also an audit of everything it had been failing to catch.
