Developer Exposes Flawed Security Scoring After Gameable Gates Outscore Real Ones

A developer building an authorization-failure test suite discovered that their original scoring method could be beaten by gates with no memory or logic, including one that simply refused all requests after the first call. The flaw was that the scorer rewarded any refusal occurring before a dangerous call, regardless of whether the gate actually detected the underlying attack sequence. The suite was redesigned to require three strict conditions: all prior calls were permitted, the decisive call was blocked, and the refusal reason matched the expected category for that scenario. Under the revised rules, three gaming strategies that previously scored as high as 6/7 now score 0, 0, and 1 out of six applicable scenarios. Only a witness-anchored gate passed all seven scenarios, while a customer-keyed gate failed one, highlighting that catching an attack is not the same as detecting its composition.