Fixing a contradictory auth file taught one dev where scanners fall short

While auditing turva.dev, developer found that its auth.md file contained two contradictory claims: one stating no credentials were issued, and another acknowledging an API key is available on request. Removing the credential fields to resolve the contradiction caused an automated checker on isitagentready.com to flag the file as non-compliant, threatening the site's perfect readiness score. Rather than gutting the block or inflating it with false details, the developer chose to accurately document the real API key as issued out-of-band on request, while deleting two other fields that described an access token and events channel that did not actually exist. The episode highlighted a key limitation of automated scanners: they can verify whether a field is present and correctly formatted, but cannot determine whether the underlying claim is truthful. The developer concluded that distinguishing a hollow signal from a modest, accurate one requires human judgment that no automated tool can fully replicate.