1,558 green tests and an open auth hole is the best argument in the post. Coverage measures what you thought to check, and auth bugs live in what nobody thought to check. The evidence trail I trust most is a short list of abuse cases written before the code, each with a test that fails first. Would you count a threat model with linked failing tests as part of that career evidence?

iin1006h00