fable 5 found a timing attack vulnerability in my production postback endpoint that opus 4.8 missed. a 1-line string comparison leaking auth secrets through response latency. both models had the code. neither flagged it initially. i didn't catch it either.
the difference: opus goes deep on single files, writes throwaway programs to prove bugs exist. fable works like an audit lead, carves the codebase into zones, spawns parallel agents, then validates every finding before reporting. same 6,200 lines of go and typescript. same ssh access. radically different coverage.
opus caught 4 things fable missed (dead routing, orphan clicks, idempotency issues with proof). fable caught 4 things opus missed (postback timing, root services, slowloris surface, cli exposure). not competing at the same job.
the moment fable earned its price tag: flagged litestream backup as critical missing, then ssh'd in, ran systemctl is-active, found it was actually running, reclassified to informational. caught a shell injection on a url parameter, traced it through urlsearchparams encoding, proved it wasn't injectable, downgraded. two criticals eliminated without me opening a file.
audit quality isn't measured by finding count. it's measured by not shipping with timing leaks in your auth layer.
i build and ship daily with claude code. saas, tools, automations. ⭐ if ai can build it, i've probably broken it first. what works → link in bio