A clean pentest report used to be good news. Against a codebase where most new code originates in an assistant, it might mean the testers were looking in the wrong decade. A red-team lead walks through what changed, what still works, and the finding that never makes the report.