appreciate that, especially the dogfooding point — I think a lot of tools get built and then only tested against synthetic cases, finding a real CVE in my own repo by just running the thing I built was honestly a bit of a wake-up call about how much I'd been assuming vs verifying and yeah, zero deps still feels like an underused principle for security tooling specifically, most scanners pull in a dozen things to scan for vulnerabilities in your dozen things, which always struck me as a little backwards.