Spent this week finding out our behavior engine had never run in production.
One missing API key. Every scan silently returned UNKNOWN instead of erroring.
Found it by running the thing instead of reading the code. Third bug this month of the exact same shape.
We tested our own scanner against a labelled corpus.
First run: 29.4% F1. Blue-chip false positive rate 17.4% — we flagged USDC, Aave and BUSD as elevated risk.
Publishing that because the number after the fixes only means something if you saw the one before it.
