Why your scanner said clean and we did not

The scan was clean because the scanner asked the questions it knows how to ask. It checked versions, it checked headers, it checked for the vulnerabilities that have names.

We got in through a password reset flow that leaked whether an address existed, an enumeration endpoint with no rate limit, and a support tool that trusted a header the load balancer did not strip. None of those three is a vulnerability on its own. Together they are an account takeover.

A scanner finds vulnerabilities. An operator finds paths.