Packet Loss

The pentest report was done. Marcus read it one more time, hated it one more time, and exported it to PDF.

He attached it to the Jira ticket, typed "Findings attached, happy to discuss," and closed the tab before the lie could settle. The ticket's due date said November 2, 2027. Three days ago. Nobody was going to discuss it. Nobody ever discussed it. The client's internal API had accepted negative dollar amounts in transfer requests, which meant you could theoretically steal money by depositing it in reverse, and Marcus had spent three hours formatting that finding into Vantaris's branded template so it could land in someone's inbox and never be opened.

Three months at Vantaris Systems. Austin's own mid-tier cybersecurity consultancy, occupying the third floor of a glass-and-concrete building off Lamar that smelled like carpet cleaner and ambition that had curdled into process. The AppSec team had cleared out by five. Marcus stayed because the office Wi-Fi was faster than his apartment's and because going home meant admitting the day was over and nothing interesting had happened in it.

He leaned back and stared at the ceiling tiles. The ceiling tiles offered no rebuttal.

Later that night, a stranger on an invite-only forum would post an API endpoint, a bearer token, and one line of instructions — Test it on something you think is safe — and one of the core assumptions underneath modern public-key cryptography would quietly stop holding.