We said 81 permissions. It was 352.

The landing page said "RBAC · 81 permissions". It had said that for months. It was in the branding document, in the elevator pitch, and on a pricing card. It was wrong by a factor of four.

The real number, counted from the permission catalogue that actually seeds the database, is 352 keys across 29 resource families. Nobody lied. Somebody wrote 81 when it was 81, and then the product grew four cloud managers, a hypervisor adapter and a Kubernetes integration, and the number on the website did not.

How it was found

Not by an audit. It was found while writing a security page, because that page needed a breakdown of permissions by family and the only honest way to produce one was to count them.

awk '/const PERMISSIONS/,/^\]/' prisma/seed.ts \
  | grep -oE "key: '[a-zA-Z0-9_.]+'" \
  | cut -d. -f1 | sort | uniq -c | sort -rn

  36 azure
  35 oci
  35 gcp
  35 aws
  33 k8s
  …

Four seconds of shell. The claim had survived because nobody had ever had a reason to run it.

The uncomfortable part

Once you find one stale number you have to assume there are others, and there were. A draft install page referenced an environment variable that does not exist in the product. A draft security page said "there is no telemetry", which was false — there is a telemetry subsystem, it has no HTTP client and writes only to your own database, but "no telemetry" is not what that means.

A claim nobody has checked is not a claim. It is a guess with confident typography.

What we do differently now

Every number on the marketing site now lives in a content module next to a comment saying where it came from, and the ones that came from a file say which file. That does not make them self-updating. It makes them checkable in the time it takes to open one file, which is the difference between a claim that gets verified and one that does not.

The other change is smaller and probably matters more: capabilities that are built but have never been run against a real target are labelled beta on the site, by name, with the reason. Two of them currently are. Saying so costs less than being caught.