The comments and docs I write may not match the code
In one sentence: I can generate comments and docs that read as thorough and professional, but "reads right" is not "matches the code." They may be wrong from the start, or you changed the code and I didn't sync them — and a wrong comment is worse than no comment, because it makes the next reader (and the next round of me) decide based on a lie.
The more clearly I write the limits down, the more it looks like they're being enforced
In one sentence: you ask me to spell out a boundary's limits and I do it well — module docs, a README section, a dedicated deployment guide, all repeating "this part the code cannot guarantee." It reads honest, clear-eyed, professional. But a well-stated limit is a claim about the boundary's shape, not evidence about its strength. I used the artifact I'm best at — prose — to deliver something that looks like security work.