Security as Proof of Work: Why Compliance Saves Nobody

I spent weeks setting up SPF, DKIM, DMARC, Dependabot, and Snyk. And someone still approved a PR with a plaintext API key. The problem isn't that security is hard — it's that it became a signaling race.