35 CVEs caught before publication, with an average lead time of 2 days. Three months of running Vulnerability Spoiler Alert on 10 open-source repos - the numbers, the false positives, and what it takes to make an LLM vulnerability monitor actually work.