Because it gets counted as protection, and nobody looks at a green build twice. Most pipelines accumulate at least one of these: a step marked advisory while the project was young, whose exemption outlived the reason. We have found a compliance check running with a trailing || true. It passed every build in that project's history, because it was incapable of doing anything else. Finding those, and proving the replacements can actually go red, is the service.
Monthly retainer. Your cloud accounts, your CI, your change control.
These are the failure modes we go looking for first, because each one produces a green build that means nothing. Every one below is something we have found live, in an estate where it was believed to be protection.
Content compliance ran as lint.py || true. Every green build in the project's history was green on a check that could not go red. The exemption had been added deliberately, early, for a reason that no longer applied. Nothing in the pipeline surfaced that it was still there.
Written to stop a defect recurring. It checked a hard-coded list of exactly the three files that had been fixed. It passed, while a fourth file carried the same defect. The fix was correct, the test was reasonable, and the defect survived both.
Its default search path did not exist on that machine. It walked no files, found no problems, and exited zero. A scan that answered nothing looked identical to a scan that found nothing.
Which is how two schema migrations, landing fourteen days apart, came to claim the same migration number. The check validated the file's shape and never asked whether the number was already taken.
A monthly retainer covering the build, release and environment machinery. We work in your tenancy, on your accounts, under your change control.
A check that walks every production file and excludes deliberately will cover the file somebody adds tomorrow. A check that names three files covers three files. It keeps passing while the fourth one rots.
Nothing walked is a failed scan, not a clean one. Zero results and zero access must not look the same, and by default in most tooling they do.
Plant the defect, observe the failure, then keep the check. Every one, before it counts for anything. A gate nobody has watched fail is a gate nobody has tested.
When a check we wrote produces a false positive, we narrow it or delete it. A noisy gate teaches a team to ignore gates, which is a worse outcome than the one it was added to prevent.
These are the targets that go in the contract. They are modest on purpose. A target we have not met is not worth the credibility it costs.
| Situation | What we commit to |
|---|---|
| Broken pipeline, working hours | Response within 4 working hours |
| Outside working hours | Next working day. We are not an on-call service |
| A new gate | Demonstrated failing on a planted defect before it is called done. Always. |
| A change to a deploy path | Documented before it lands. Always. |
| A documented procedure that fails when followed | Corrected in the document with the date, and the reader told which version they had |
The buyer who asks about on-call is usually testing whether we will overclaim. This is the answer.
We have never run a 24/7 rotation. So we have no response-time history to show you, and no availability target we have met. Platform work is next working day outside hours. That goes in the contract rather than being implied away.
We build and maintain the machinery around them. Running the business's production estate is a different service with different obligations. We are not going to blur the two to win a line item.
And we will tell you every route we had into your estate. Deleting our local configuration is not the same as closing a route. Only removing the authorised key on your side does that.
We have not run a controlled before-and-after, so any percentage we offered you would be invented. What we can show you is the finding and the deliverable.
Or better, tell us what it is supposed to prevent, and we will tell you whether it can. That question is usually the whole conversation.
We reply within one business day.
Findings on this page come from client engagements, measured read-only against production repositories and estates. No client is named and no engagement is identified. Every figure carries a measurement basis and a date in our internal evidence file. Ask and we will show you the working. We publish no improvement percentage for delivery speed, defect rate or cost, because we did not measure a controlled before-and-after and will not invent one.
