We started auditing popular OSS security libraries as an experiment. first week, we found a critical auth bypass in pac4j-jwt. How long has your enterprise security stack been scanning this package? years? finding nothing? we found it in 7 days.

either:

1/ we're security geniuses (lol no)

2/ all security tools are fundamentally broken

spoiler: it's B.

I mean, what is happening? why the heck engg teams are paying $200k+ to these AI tools??? This was not reported in 6 yrs btw.