Security people don't trust documentation because documentation is evidence, not truth.
Attackers don't exploit diagrams or API specs.
They exploit implementation.
The source of truth is production — and production often behaves very differently from what the documents describe.
