What happens when you force a security tool to inspect untrusted code using only standard-library primitives? An engineering postmortem on systems complexity and zero dependencies. Opening Hook We were building a security scanner designed to inspect untrusted repositories before developers open them in their editors. Our first instinct was standard Node.js muscle memory: npm install commander chalk fast-glob simple-git js-yaml cytoscape Then we stopped. ...