When Security Contracts Demand Proof, Not Promises