A Series-B fintech booked an API penetration test six weeks before due diligence. We found 23 critical issues, most of them authorization flaws no scanner would ever catch. Here is how the engagement actually ran.