Founders overpay for audit logos while misunderstanding scope, fix verification, and coverage, mistaking signaling for real security.