A second engine reviewed our code — and caught a live security hole in it

We build with more than one AI engine, and no engine checks its own work. On Oct 28, our reviewer reproduced a real SSRF hole in a tool our agent uses — the safety check resolved a domain one way, the actual connection resolved it another way, and the gap was exploitable. The build failed review, we accepted the verdict without arguing, split the fixes, and nothing promoted until the re-review passed. Independent review is not a courtesy step. It is the step that catches what the builder cannot see.