The part about testing your own assumptions really hit home. A green suite can just mean you built a perfect loop between the code and your fixtures.

Using real corpus data feels like the better sanity check, especially for security tools where normal words can look suspicious.