Writing
Arguments about how this ought to work, rather than announcements. Every one of them is a decision that is visible in the product.
Nobody buys a list of vulnerabilities
The security industry sells detection because detection is what it can measure. The thing customers are actually asked for is proof that something was fixed — and almost nothing produces it.
Severity is not priority, and treating it as one is why nobody uses your scanner
A CVSS score is computed without knowing whether the code is reachable, what the system holds, or who can get to it. Sorting by it produces a list that is wrong at the top.
What a free scan may actually do to you
We built a public scanner and drew the line at what a browser does. Here is why, and what it costs us.