In Episode 11, Nova runs the scan, the scan says “all clear”, and the site is hacked the next morning. Both things are true. A scanner looks for known weaknesses in code and dependencies. The hole was a credential, and no scanner reads minds.
What a scan checks
- Known vulnerable versions of plugins, themes, libraries and the platform.
- Code patterns that look unsafe: unescaped output, raw SQL, missing nonces.
- Obvious misconfigurations it can reach from outside: directory listings, exposed files.
What a scan can’t check
- Weak or shared passwords. A scanner doesn’t log in.
- Accounts that shouldn’t exist. A test admin looks exactly like a real one.
- Where your data came from. A database restored from development brings development’s users with it.
- What the assistant did on the way. “Copied the test user to production” never shows up as a CVE.
Prompt to steal
Before we release, list every account that exists on production, where each
one came from (created by hand, seeded, restored, copied), and its role.
Flag any account whose password was ever used in development.Run the scan. Then run the question the scan can’t ask.